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Prologue 



On March 11, 2011, a large part of the Japanese eastern coastal area was struck by an 
earthquake of enormous magnitude, followed by a devastating tsunami. This natural disaster 
killed thousands of people and caused extensive damage to Japanese cities and 
infrastructure. After the earthquake, the nuclear reactors from the Japanese Nuclear Power 
Plant station Fukushima Dai-ichi shut down automatically. However the station failed to 
adequately maintain all of its safety functions after been hit by the tsunami initiated by the 
earthquake. As a result the local environment suffered from radioactive releases, requiring 
large zones to be evacuated, and generating serious concerns internationally about nuclear 
safety. 

In the wake of the disaster the European Union decided to assess safety of all operating 
nuclear power reactors in its member states. This safety assessment focusses on extreme 
natural hazards, beyond the Standard safety evaluations which regularly have to be 
performed to demonstrate the safety of a nuclear power plant and addresses the safety 
margins of nuclear power plants in the light of the events which occurred at Fukushima: 
extreme natural events challenging the plant safety functions and leading to a severe 
accident. 

The Dutch Regulatory Body asked the Reactor Institute Delft (RID) to perform a safety 
assessment for the Hoger Onderwijs Reactor (HOR). 

Consequences of these extreme hazards for the HOR at the RID premises have been 
evaluated using available safety analyses, supplemented by engineering judgement. In this 
way, the robustness of the research reactor was assessed and the safety margins were 
identified. The present report documents the results of this Complementary Safety margin 
Assessment (CSA). 
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Executive Summary 



Complementary Safety margin Assessment (CSA) 

As a consequence of the accident at the Fukushima Dai-ichi Nuclear Power Plant (NPP) in 
Japan, the European Council meeting on March 24th and 25th 2011 declared that 'the safety 
of all EU nuclear plants should be reviewed, on the basis of a comprehensive and 
transparent risk assessment ('stress tests'). Based on this decision, the Dutch Ministry of 
Economie affairs, Agriculture and Innovation (EL&I) requested RID, the operator of the 
Hoger Onderwijs Reactor (HOR) to perform a stress test of this facility based on the ENSREG 
specifications. In addition, the Ministry indicated that 'deliberate disturbances' should be 
taken into account as well. This request was implemented by RID as the Complementary 
Safety margin Assessment (CSA) of the Hoger Onderwijs Reactor (HOR) of which the results 
are documented in this report. 

Methodology 

The methodology of the assessment consists of evaluating the HOR's response when facing 
a set of extreme situations and verifying the preventive and mitigative measures necessary 
to ensure the safety of the reactor. In this assessment, the possibility of cliff-edge effects 
beyond the level of protection is identified. 

The assessment approach is essentially deterministic: when analysing an extreme scenario, 
sequential loss of protective systems and measures is assumed, regardless its credibility. 

The assessment considers three elements: 

• Provisions incorporated in the design basis and the facility's conformance to its 
design requirements; 

• Evaluation of the design basis; 

• Assessment of the margins "beyond design"; how far can the design envelope be 
stretched until accident management provisions (design and operational) can no 
longer prevent fuel damage and/or a radioactive release to the environment. 

The assessment of the margins "beyond design" might require information about the plant 
that is not always available. In those cases engineering judgement has been used to 
conservatively determine the margins. 

The assessment leads to insights into severe accident conditions and how the HOR responds, 
even if measures provided for that situation would fail. The intention is that an increasing 
threat (for example, an increasingly higher flood level) is assumed, so as to determine how 
the HOR responds and to what level of threat the safety systems work adequately. Following 
a deterministic approach for assessing the safety margins for the different issues, it is 
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important to know the likelihood of such an event as basis for possible further evaluation 
and improved measures. This information is also presented in this report. 

The following issues are dealt with: 

• Earthquake; 

• Flooding; 

• Extreme weather conditions; 

• Loss of electrical power and loss of ultimate heat sink; 

• Severe accident management; 

• Other extreme events. 

CSA in relation to continuous improvement at the HOR 

Within RID safety, including nuclear safety, has overriding priority both in organisation and 
operations. This is implemented through a pro-active approach to prevent and control 
possible hazards with respect to safety of individuals and the environment and a pursuit of 
continuous improvement. 

Part of this is the execution of an extensive safety evaluation, scheduled every 10-years, 
concerning nuclear safety and radiation protection. The objective of this evaluation is to 
compare the existing situation to the state-of-the-art requirements and best practices using 
a comprehensive assessment as to whether the design basis and the safety documentation 
are still valid, arrangements in place to assure the plant's safety are still correct and 
effective, and the reactor complies with current national and international standards and 
practices. 

RID recently completed this safety evaluation for the period 2000-2010 that resulted in a 
series of recommendations to improve the design, operation and organisation of the HOR 
and RID respectively. 

The underlying CSA expands this assessment and reviews the robustness of the HOR. 

Main conclusions of the assessment 

The main conclusion on the robustness of the Hoger Onderwijs Reactor against the assessed 
extreme events can be summarized as follows. 

Basically the HOR is safe and sound designed and operated; it is very robust and hardly 
impacted by the hazards under consideration, unless extreme limits are exceeded. This is 
due to its design that makes the HOR almost independent from internal and external support 
(systems) to assure the basic safety functions of reactivity control, cooling and confinement. 
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In this respect, maintaining these functions is: 

• Independent from electrical power supply, both by the external grid and/or by the 
diesel generator; 

• Assured as long as pool water is available for processing of the decay heat, by 
heating-up and evaporation. It takes years before uncovering of the core occurs; 

• Performed by "fail-safe" isolation valves of the pool and of the containment. 

Therefore no additional measures are included in the design to deal with extending extreme 
events. 

Nevertheless, improvements in this respect may be found in dealing with issues that are 
related to the loss of pool water as a single event or in combination with loss of confinement. 

The alternative cooling by air is not unambiguously demonstrated. Preparedness by means 
and procedures to mitigate consequences of such extreme events should be reconsidered. In 
some cases robustness can be increased by implementation or enhancement of procedures 
or instructions. In addition, despite the robustness of the HOR, recommendations have been 
made to extend the monitoring capabilities. This to assure that at any circumstances 
information is available that confirms that the HOR is in a safe state. 

The recommendations to improve the robustness of the HOR are summarised below. 
Distinction is made between measures, studies and procedures or instructions. 



Summary of recommendations 



Implementation of these measures will most probably require 


Origin 


hardware modifications 




Ml 


The magnetic holding force of the control rods should be tested to 
ascertain the assumption that drop of these rods into the core will occur 
in case of the type of earthquakes to be expected in the Delft region. 


Ch 2.2.4 


M2 


For extreme rainfall the roof of the control room is not sufficiently 
protected. It is recommended to provide the roof of the control room 
with blocking proof rainwater drains, like overflow holes, to prevent 
accumulation of rainwater and exceedance of the roof design load. 


Ch 4.1.1.5 


M3 


If practically achievable, connect the containment ventilation system to 
the Diesel Generator in order to maintain filtering capabilities after loss 
of off-site power 


Ch 6.3.9 
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In the framework of the CSA, the maximum resistance of the HOR 
against external events has been investigated, whereas 
traditionally the HOR design is investigated against certain pre- 
defined external events. These different approaches require 
different analysis and studies. Within the timeframe of the CSA, it 
was not possible to perform extensive studies and in some cases 
engineering judgment has been applied for establishing the 
margins. In general a conservative approach is chosen when 
applying engineering judgment. In some areas, additional studies 
could therefore reveal that the actual margins are larger than those 
margins presented in the CSA report. Furthermore, in some cases, 
additional studies could reveal measures for further increasing the 
margins. 


Origin 


SI Evaluation of loss of coolant possibilities of the HOR 

If draining of the pool in case of pipe-break immediate underneath the 
connection to the pool appears to be an issue, measures should be 
invesiigarea 10 isoiare tms Kina or leaKages. 


cn b.i.z./ 


S2 The cooling capabilities in case of loss of pool water should be 
investigated. Evaluation of the core / spent fuel integrity during 
cooling of the core partly covered by water or cooling of the core by 

air . 


Ch 2.2.4 
Ch 5.1.2.7, 
Ch 5.2.2.1 


S3 A seismic evaluation of the HOR stack is recommended. 
(Connection with S4/S5 and vice versa) 


Ch 2.2.4 


S4 It is recommended to investigate the allowable wind load on the 
ventilation stack. 

(Connection with S3/S5 and vice versa) 


Ch 4.2.2 


S5 The possible impact of the ventilation stack on the reactor building 
should be investigated. 
(Connection with S3/S4 and vice versa) 


Ch 2.2.4 
Ch 4.2.2 


S6 Revise and clarify the organizational chart in the RID Emergency Plan 
(e.g. replace IRI by RID). 


CH 6.1.5 


S7 Investigate/determine the fire resistance of the synthetic plate 

material at the inside of the containment; perform a fire analysis from 
the viewpoint of nuclear risks. 


Ch 7.3.2 


S8 Evaluation of the emergency plans which need to be activated in case 
of an APC with core damage and release of radioactive material. For 
this, a HOR specific APC accident analysis should be performed in 
order to make reliable estimations of the consequences. 


Ch 7.5.2 
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S9 


Investigate the needs for monitoring the condition of the HOR in LOOP 
or SBO situations, the availability of the diesel generator and UPS 
related to their (time-limited) capacity to supply power and assure 
monitoring; increase of the battery capacity might be possible 


Ch 5.1.1.5 


S10 


Evaluate advantages of introducing a load reduction or load shedding 
programme in case diesel fuel saving is needed to extend operation 
time of the diesel generator when refuelling fails. 


Ch 5.1.1.5 


Sll 


Investigate if the water seal needs modification in such a way that 
flooding of the inlet will not result in higher "seal break pressure". 


Ch 3.3.2 


S12 


Investigate possibilities to extend the monitoring capability in the 
alternate Alarm Staff Room (L&R building) by availability of measuring 
data and E-power. 


Ch 5.1.1.5 


S13 


Evaluate the resistance against earthquake loading of the two support 
points of the staircase to the central turn pivot of the crane. 


Ch 2.2.1.4 



The CSA showed that the robustness of the HOR against external Origin 
hazards can be increased further by implementation of a number of 
procedures. 



PI Although means to supply water to the storage tank are available, an 
instruction is missing and should be drafted. 
Drafting a procedure for: 

• Replenishment of pool water by supply of water stored in 
several tanks inside RID. 

• Implementation of supply of water to the storage tank by the 
fire fighting system. 

Training and testing should be defined in this procedure as well. 
P2 Improve means for diesel fuel transfer from the main tank to the day 
tank and provide a procedure or instruction for refueling of both 
tanks during emergencies or long term loss of off-site power; assure 
diesel fuel supply. 

P3 Make an inventory of equipment of Fire Brigade Haaglanden and Ch 6.1.5 

adjust plans for possible emergency provisions, 
P4 Both procedures in "Bedrijfsnoodprocedures" and the "Aanvalsplan" Ch 6.1.5 

for containment pressure reliëf should be checked on consistency 

(1 kPa versus approaching 10 kPa) and effectiveness. 

Add the instruction that consultation of Radiation Protection Service 

(SBD) is needed about internal recirculation over the filters in order 

to reduce release fractions before pressure reliëf. 
P5 Check the preparedness of local emergency services (e.g. Ambulance Ch 6.1.5 

personnel) for radiological events. 



Ch 2.2.4 
Ch 5.1.2.7 
Ch 6.2.3 



Ch 5.1.1.5 
Ch 6.1.5 
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P6 For the relocation of the core to the other pool section in case of loss 
of pool water, the handling time and dependence on tools or 
equipment should be evaluated by performing a training exercise of 
the existing emergency instruction. The required time will determine 
the leak rate that can be handled. The identified tools, dependencies 
(e.g. E-power for polar crane for spent fuel relocation) and expected 
dose rates will make it clear in what situations relocation is an 
option. 

P7 The instruction on core relocation in case of a leak in pool section 2 Ch 5.2.2.1 
should be complemented by guidance on the handling of spent fuel Ch 6.2.3 
(depending on their ability to cool in air, connection with S1/S2). 

P8 The existing instruction for refilling the water seal should be checked Ch 6.3.9 
for applicability in case of an unfortunate "break" of the seal as to 
restore the confinement function. 

P9 An evaluation if the current emergency plans give sufficiënt guidance Ch 6.4.4 
in the extreme event of uncovering of the fuel. 



Ch 5.1.2.7 
Ch 6.2.3 
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List of abbreviations 



AC Alternating Current 

AIS Automatisch Indrijven Staven (power reduction) 

APC Airplane Crash 

AUHS Alternate Ultimate Heat Sink 

BDBA Beyond Design Base Accident 

BHV Internal First Response/Aid 

BIS Bassin ISolatie (isolation of the pool) 

BISNIS Big Sample Neutron Irradiation System 

COSYMA Code System for Maria (the EC program Methods for Assessing the 
Radiological Impact of Accidents) 

CRS Central monitoring system 

CSA Complementary Safety margin Study 

DC Direct Current 

DBA Design Base Accident 

DBE Design Basis Earthquake 

DBR Dry Irradiation Room 

EMS European Macro-seismic Scale 

ENSREG European Nuclear Safety REgulatory Group 

ERO Emergency Response Centre 

FMVG Facilities Management and Real Estate 

HEPA High Efficiency Particulate Air (filter) 

HOR Hoger Onderwijs Reactor 

IAEA International Atomic Energy Agency 

IPCC Intergovernmental Panel on Climate Change 

IRI Interuniversitair reactor Instituut 
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KFD 


Nuclear Inspectorate 


KNMI 


Royal Netherlands Meteorological Institute 


LAHS 


Loss of Alternate Heat Sink 


LEU 


Low Enriched Uranium 


LOCA 


Loss of Cooling Accident 


LOOP 


Loss Of Offsite Power 


LUHS 


Loss of Ultimate Heat Sink 


MMI 


Mercalli Intensity Scale 


MTR 


Materials Testing Reactor 


NAP 


Nieuw Amsterdams Peil 


NPK 


National Plan for Nuclear Emergency Planning and Response 


NPP 


Nuclear Power Plant 


NVR 


Nucleaire Veiligheids Richtlijnen (Nuclear Safety Rules and Guidelines) 


OLC 


Operating Limits and Conditions 


RBV 


Reactor BedrijfsVergrendeling (reactor operation locking) 


RID 


Reactor Instituut Delft 


RIS 


Reactorhal ISolatie (isolation of the reactor hall) 


RIVM 


Governmental Institute for Public Health and Environment 


RK 


Regel kamer (control room) 


RPS 


Reactor Protection System 


RSA 


Reactor Snel Afschakeling (scram) 


RSV 


Reactor Start Vergrendeling (start-up locking) 


RWS 


Rijkswaterstaat; department of the Ministry of Infrastructure and Environment 


SAM 


Severe Accident Management 


SBD 


Radiation Protection Department 


SBO 


Station Black Out 
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SSC Systems, Structures and Components 

TU Delft Technische Universiteit Delft 

UHS Ultimate Heat Sink 

UPS Un-interrupted Power supply System 

WENRA Western European Nuclear Regulator Association 
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Introduction 



Background and objective 

As a consequence of the accident at the Fukushima Dai-ichi Nuclear Power Plant (NPP) in 
Japan, the European Council meeting on March 24th and 25th 2011 declared that "the safety 
of all EU nuclear plants should be reviewed, on the basis of a comprehensive and 
transparent risk assessment ('stress tests')". 

On the basis of the proposals made by the Western European Nuclear Regulator Association 
(WENRA), the European Commission and members of the European Nuclear Safety 
Regulatory Group (ENSREG), it was decided to agree upon "an initial independent regulatory 
technical definition of a 'stress test' and how it should be applied to nuclear facilities across 
Europe". The "EU 'stress test' specifications" were finally provided by ENSREG. 

These EU wide tests will be an addition to the safety standards already in place at national 
level. The aim of these tests is a targeted re-assessment of the safety margins of nuclear 
power plants in the light of the events which occurred at Fukushima: extreme natural events 
challenging the plant safety functions and leading to a severe accident. 

RID has agreed with the regulator to voluntary participate in the stress test as outlined in 
the ENSREG specifications(reflected by the table of contents). 

In addition the regulator indicated that in the assessment 'deliberate disturbances' should be 
taken into account. This request was implemented by RID as the RID Complementary Safety 
margin Assessment (CSA) of which the results are presented in this report. 

The objective of the CSA is to perform a reassessment of the design basis, the safety 
margins and cliff-edge effects of the HOR research reactor at the RID site and is mainly 
based on the guidance provided by ENSREG regarding the so-called 'stress-test'. This 
assessment consists on the one hand of an evaluation of the response of the HOR research 
reactor facing a set of extreme initiating events like earthquake and flooding, and on the 
other hand of a verification of the features the design encloses to ensure the safety of the 
HOR research reactor. 

The CSA focuses on extreme natural events like earthquake and flooding. It will also assess 
the consequences of loss of safety functions due to indirect initiating events like a large 
disturbance from the electrical power grid impacting AC power distribution systems, external 
fire or airplane crash. Furthermore, an assessment of man-made and of other extreme 
natural events has been carried out. 
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Assessment methodology 

The methodology of the assessment consists of evaluating the HOR's response when facing 
a set of extreme situations and verifying the preventive and mitigation measures necessary 
to ensure the safety of the reactor. In this assessment, the possibility of cliff-edge effects 
beyond the level of protection is identified. 

The assessment approach is essentially deterministic: when analysing an extreme scenario, 
sequential loss of protective systems and measures is assumed. 

The assessment considers three elements: 

• Provisions incorporated in the design basis and the facility's conformance to its design 
requirements; 

• Evaluation of the design basis; 

• Assessment of the margins 'beyond design'; how far can the design envelope be 
stretched until accident management provisions (design and operational) can no 
longer prevent fuel damage and/or a radioactive release to the environment. 

The assessment of the margins 'beyond design' might require information about the plant 
that is not always available. In those cases engineering judgement has been used to 
conservatively determine the margins. 

The assessment leads to insights into severe accident conditions and how the HOR reacts, 
even if measures provided for that situation would fail. This means that for the 
determination of the safety margins, a deterministic approach is chosen. The intention is that 
an increasing threat (for example, an increasingly higher flood level) is assumed, so as to 
determine how the HOR system respond and to what level of threat the safety systems work 
adequately. Following a deterministic approach for assessing the safety margins for the 
different issues, it is important to know the likelihood of such an event as basis for possible 
further evaluation and improved measures. This information is also presented in this report. 

The following issues are dealt with: 

• Earthquake; 

• Flooding; 

• Extreme weather conditions; 

• Loss of electrical power and loss of ultimate heat sink; 

• Severe accident management; 

• Other extreme events. 

In chapter 2 up to and including 7 these issues are elaborated, preceded by chapter 1 that 
lists the general data of the reactor and the site. 
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1 General data of the site/plant 



1.1 The Reactor Institute Delft 

The Reactor Institute Delft (RID) is part of the Faculty of Applied Sciences of the Delft 
University of Technology. The RID operates one research reactor: the Hoger Onderwijs 
Reactor (HOR). According to the Dutch Nuclear act, the Executive Board of the university, 
being the licensee, is responsible for the HOR. 

1.2 Brief description of the site characteristics 

The RID is located at the premises of the Delft University of Technology, nearby the city of 
Delft (see Figure 1-1), in the western part of the "Zuidpolder van Delfgauw" area. 
Neighbouring towns, within a distance of approx. 5km. are Delft, Pijnacker and Schipluiden. 
The HOR encloses several buildings. A picture is shown in Figure 1-2. 




Figure 1-1 : Location of the RID site 
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Figure 1-2 : View of RID site 



The shortest distance of the reactor to the boundary of the RID premises (public area), the 
Mekelweg, is 75m. An area with a diameter of 300m, surrounding the HOR, encloses a few 
buildings of the university. These buildings reside south of the Kruithuisweg which is situated 
at a distance of 400m to the HOR. A listing of these buildings and their related distances is 
presented in Table 1-1. 



Table 1-1: Buildings in the neighbourhood of the HOR 



Building 


Distance 


Employment houses 


100 m 


Division transport & Logistics (TU Delft) 


200 m 


The Fellowship (TU Delft) 


300 m 


Facility Management & vastgoed (TU Delft) 


300 m 



The centre of the city of Delft is situated approximately 2km from the RID, in north-west 
direction. West of the RID, at 800m, a canal, the Delftse Schie, is located, that connects 
Rotterdam and Den Haag. The railway between these two cities passes at l.lkm; a business 
park is situated between the Delftse Schie and the railway. West of the railway, at 
approximately 1.2km distance of the HOR, lies the residence area Tanthof. 
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The highway A13, from Rotterdam to Amsterdam, runs east of the RID, at 600m distance of 
the HOR. East of the A13 there is a business park at 700m. At lOOOm north-east of the HOR 
there is a district of the town of Delfgauw. 

South of the HOR an expansion of Technopolis, a business area enclosing severalindustries, 
is planned. At present Deltaris and Holland Metrology are at a distance of 600m. 
Furthermore on the south side there is the polder of Midden Delftland that houses several 
farms and the municipality of Kandelaar at 3.5km.The northern border of the town of 
Schiedam is at 4.5km distance south of the HOR. 

Rotterdam - The Hague airport is situated at a distance of 6 km to the south, the North Sea 
at 15km to the west and the Nieuwe Waterweg, the open waterway from the port of 
Rotterdam to the North Sea at 12km to the south. 

Ground level (MAAIVELD) and at the same time level of the reactor hall floor is -1.2m NAP, 
see Figure 1-3. The water level of the site is controlled by the electric pumping stations of 
the Delftse Schie; this level is the reference (water) level of the "Zuidpolder van Delfgauw", 
the RID area, it is at -2.8m NAP (Amsterdam zero level) so 1.6m below ground level. 

The seismic and geologie characteristics of the soil of the RID site do not require extra 
provisions of the design. The area is considered to be non-seismic. 




Figure 1-3 : levels at RID site, with ground or 'MAAIVELD' level at -1.2 m NAP. 
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1.3 Main characteristics of the unit 

The HOR is facilitated by several buildings and constructions (see Figure 1-4). 

□ r 




00 




01 
















03 
^3 



02 



P= pompgebouw 
EH= experimenteerhal 
RH- reactorhal 
RC= regelkamercomplex 
KH- ketelhuis 
G= dieselgenerator 



V= ventilatieschacht 
00- vleugel 
01= vleugel 1 

02- vleugel 2 

03- vleugel 3 
04= vleugel 4 



Figure 1-4: Site map of the RID 

Successively the following facilities and systems will be described: 

Reactor; 
Core; 

Fuel storage; 
Reactor cooling system; 
Reactor hall; 
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• Control room and instrumentation; 

• Ventilation; 

• Water clean-up and make-up system; 

• Electrical power system; 

• Experimental facilities; 

• Auxiliary systems. 

The main characteristics of the HOR are listed in Table 2-1. This table includes a "control 
action" column that indicates scram (RSA) or power reduction (AIS) actions of the reactor 
protection system or the control system respectively in case indicated limits (column 2) are 
exceeded. 



Table 1-2: Main characteristics of the HOR 



uescription 


vaiue 


L-Ontroi dCcion 


General: 






type 


pool 




maximum power level 


3 MW 




nominal power level 


2 MW 




moderator 


water 




coolant 


water 




Containment system 


reactor hall 




volume reactor hall 


20000 m 3 




minimum flow ventilation system 


2.4 m 3 /s 


AIS 1 


maximum under-pressure 


1 kPa 


Breakthrough of water seal 


maximum over-pressure 


10 kPa 


Breakthrough of water seal 


Pool: 






wall thickness 


1 - 2.5 m 




depth 


8300 mm 




cladding 


stainless steel 




number of sections 


2 




total volume 


250 m 3 




volume section 1 


75 m 3 




volume section 2 


175 m 3 




minimum water level 


8205 mm 


RSA 2 and BIS 3 



1 Automatisch Indrijven Staven (power reduction) 

2 Reactor Snel Afschakeling (scram) 

3 Bassin ISolatie (pool isolation) 
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Description 


value 


Control action 


Coolino 1 

1 1 i y ■ 






until 750 kW power operation 


natural 




un to 3MW nowpr onpration 

KA IJ K.KJ *J 1 1 V V VJ KJ V v<w 1 KJ IJ 1 ULIvl 1 


fnrrpd 




minimum coolant flow 


74.4 dm 3 /s 


RSA 


nominal T p00 | 


35 °C 




maximum T i 

1 1 icjaii i iui 1 1 i pool 


40 °C 


AIS 


nnminal T ■ at hpat pyrhannpr fHF^ inlpt 

i \kj\ \ ii i ia i i peimary o l i icci l cal i icj i iy ci ^i i L_y ii i icl 


35 °C 

~J ~) C 




rriaYirnurn T ■ at HF inlpt 
iiiuaiiiiuiii i prjmary " L ' " "d- 


52 °C 


AIS 


T difference HE primary-secondary side 


9°C 




Evanoration npr wppk 

LVU UV 1 KA LI \J 1 1 IJ C 1 V V ' * l\ 


3 m 3 




Co re; 






numbpr of Standard plpmpnts 

1 1 KA 1 1 1 VJ * 1 KJ 1 JLU 1 IUUI U C IC 1 1 IC 1 1 L J 


16 




numhpr nf rnntrnl plpmpnts 

1 IUI 1 IUCI \J\ LUI ILI KJ\ Cl Cl 1 ICI ILO 


4 




numhpr nf hprvllium rpflprtnr plpmpnt^ 

1 1 \Jl 1 1 1 1 KJ 1 1 V 1 1 1 KA 1 1 1 1 U.1 lv>vl.vl V IV 1 1 IC 1 1 L J 


22 




Standard plpmpnts 1 

>*J \-KA 1 1 \A KA 1 \A Vlvl 1 1 K.*J m 






tv De 


MTR LEU 




pnrichmpnt 

V. 1 II 1 V<l II 1 1 V. 1 IK. 


19.75 % 




fupl matrix 


U^Si?-AI 

KJ j **J 1 ^/ 1 \ 1 




1 r)pr plpmpnf 

KJ IJ \ 1 V IV 1 1 IV 1 1 <_ 


300 g 




numhpr nf fupl nlatpc: npr plpmpnt 

1 IUI 1 IUCI \J 1 1 UCI UIULCj UCI CICI 1 ICI IL 


19 




dimpn^inns npr fupl nlatp 

KA 1 1 1 1 C 1 UI\JI U U/V- 1 1 UCI L/IULv 


5x62x600 mm 

KJ m *J /\ KJ t—/\KJ KJ KJ 1 1 II 1 1 




Control plpmpnts 1 

\—*\J 1 ILI \J 1 V— IV— 1 1 1 V— 1 1 K.-J m 






tvnp 

Ly pc 


MTR LEU 




pnrirhmpnt 

Cl II ICI II 1 ICI IL. 


19 75 % 




fuel matrix 


U 3 Si 2 -AI 




U 235 per element 


158 g 




number of fuel plates per element 


10 




dimensions per fuel plate 


0.5x62x600 mm 




neutron absorber 


B 4 C 




control rod insertion/drop time 


<0.65 s 





1.3.1 The reactor 

The HOR is a light water reactor of the pool type. Although designed for 3MW, it is normally 
operated at a power of 2MW, due to the cooling capacity, or at 3MW for one hour per day. 

The reactor is comprised of the pool (that can be separated into two sections by the pool 
door), the bridge, the hanger, the reactivity control system, the core, the chair and the 
suction head. The core is placed in the bottom part of the hanger. The hanger itself is at its 
top fixed by the bridge while the bottom part is kept in place by the chair and the suction 
head. Figure 1-5 is a side view of the reactor pool in which all the important components are 
shown. 
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Figure 1-5: Side view of the reactor pool 

The pool is constructed of reinforced concrete and forms a monolithic construction with the 
floor of the pool. The pool consists of a small (1) and large (2) section that can be separated 
by a pool door. Barite concrete is used for the small section as the core is usually positioned 
in this section 4 . 

The pool is filled with demineralised water. The four functions of the pool water are: cooling, 
moderation, reflection and biological shielding. The water level is approximately 8.25 m. 

To prevent leakage of the pool, a stainless steel lining at the inside of the pool was installed 
in 1971. The lining consists of plates of 1 m by 2 m. The thickness of the plates is 2 mm for 
the walls, 6 mm for the floor and 1 mm for the dry irradiation chamber (see "droge 
bestralingsruimte" fig 1.14). The plates are welded together. At the bottom of the pool 



4 Technically, since the core is fixed to the bridge via the hanger, it is possible to operate the core in 
natural convection mode in other locations of the pool. However, usually the core is operated at 
2MW with forced cooling in the position above the suction head of the primary system as shown in 
figure 1.5 
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several pipes pass the concrete floor of the pool into the basement below the reactor hall (in 
Dutch: de leidingtunnel). 

1.3.2 The core 

The reactor core includes a grid plate, an experimental grid plate, nuclear fuel elements, 
control rods and beryllium reflector elements. The grid plate is made of high purity 
aluminium with a thickness of 127 mm. 42 holes in a 6 by 7 pattern are fitted into the grid 
plate onto which the nuclear fuel and beryllium reflector elements are positioned. For the 
HOR reactor core nuclear fuel elements of the MTR type are used. 

From January 2005 on, only Low Enriched Uranium (LEU) is used which contains Uranium 
Silicide (U 3 Si 2 ) with a Uranium enrichment of less than 20 %. Two types of elements are 
utilized: Standard and control elements. The Standard elements are 76 mm by 80 mm and 
875 mm long and contain 19 nuclear fuel plates. The control elements are 76 mm by 80 mm 
and 950 mm long and contain 10 nuclear fuel plates to enable the insertion of a control rod. 
A typical (Standard) HOR LEU core contains 16 Standard elements (E-xx) and 4 control 
elements EC-xx), see figure 1.6. In addition, this core includes 22 Beryllium reflector 
elements (R-xx). Two of these reflector elements provide the irradiation facilities (Bigbebe 
and Smallbebe) 




Figure 1-6: Standard HOR-LEU core 

The four control rods are part of the reactivity control system. The control rods are made of 
a flat tubular aluminum casing which is filled with granular boron carbide (B 4 C), a neutron 
absorbing material. The helium gas that is produced when neutrons are captured by boron 
carbide is then stored in aluminum wool. On the top side the control rod is provided with a 
shock damper. The shock damper is connected to an aluminum draw bar of approximately 
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7m long. Halfway the draw bar is provided with a water breaking system to reduce the 
falling rate of the control rod. On the top side the control rods are coupled to an 
electromagnet. By switching off the current, the control rods fall down by gravitational force 
within one second. 

At normal operational conditions the control rods move up and down at an average speed of 
approximately 5.5 cm/min over a distance of 66 cm by means of an independent driving 
mechanism. 

It is indicated that reactivity addition or reduction by experiments that will be placed in or 
nearby the core is taken into account at core design and efficiency check of the reactivity 
control system. 




Figure 1-7: Spent fuel positions: in the pool 
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1.3.3 Fuel storage 



Fresh fuel elements are stored in the appropriate dry storage vault. Spent fuel can only be 
stored in the storage racks in the pool. The maximum number of the spent fuel elements 
that can be stored is 78, in accordance with the OLC. 

It has been determined that k e ffective of both storage facilities will not exceed 0.95. Even when 
the dry storage is submerged by clear (non-borated) water, keffective will not exceed this 
value. Figure 1-7 shows the positions of the storage racks in the pool. 

The dry storage vault also includes one container in which fuel pins of the Delphi assembly 
are stored. It is shown that the keffective of this container is less than 0.78; also when it is 
submerged. 

1.3.4 The reactor cooling system 

The heat that is produced during reactor operation can be removed in two ways: 

• By natural convection up to a maximum power of 750 kW; 

• By forced circulation cooling up to a maximum power of 3 MW. 

At normal operational conditions, usually at 2 MW, forced circulation cooling is used. 

During natural convection the flow of the pool water is upwards through the core (buoyancy 
driven) due to density changes caused by an increasing temperature. During forced 
circulation cooling, the flow is downwards due to the suction power of the primary pump, 
which is located in the piping basement below the reactor hall (Figure 1-3). 

The primary and secondary cooling systems are open systems. The primary system includes 
the pool, the core, the pool valves, the primary pump, the heat exchanger, the controlling 
valves and the diffuser (figure 1.8). The diffuser provides a calm and downwards flow of the 
primary water that is flowing back into the pool. Because the primary water passes through 
the core it contains radioactive elements. However due to the downwards flow of the 
primary water during forced circulation cooling, the short half-life of the radio nuclides and 
the circulation time, the radiation level at the water surface remains low. The primary water 
is continuously purified by ion exchange filtering (water recycling system). This clean-up 
system takes suction at top of the pool and returns purified water to pool section 2. In case 
the pool sections are separated by the pool door, return flow to section 1 is established by 
connecting the return line of the clean-up system to the primary cooling system injection 
pool line. 

The secondary cooling system does not contain any radioactive elements and includes the 
heat exchanger, the secondary pump, (control) valves and evaporation cooling towers 
(Figure 1-8). The heat exchanger is located in the piping basement below the reactor hall. 
The secondary pump, the (control) valves and the cooling towers are located in the pump 
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building ("pompgebouw" (Figure 1-3)). Secondary cooling water is continuously drained and 
softened water is added to the secondary cooling system. 




SUPPLETIE 
SECUNDAIR 

/A TER ZUIVERINGSSYSTEEM PRIMAIR KOELSYSTEEM SECUNDAIR KOELSYSTEEM 



Figure 1-8: the heat removal system 
1.3.5 The reactor hall 

The reactor hall is the facility housing the HOR. It is shaped as a truncated cone with the 
segment of a sphere located on top. The dome is constructed of steel plates. For thermal 
isolation a layer of rock wool is placed on the outside, which in turn is covered by aluminium 
plates. On the interior acoustic isolation is fitted. The floor construction is made of reinforced 
concrete with a steel top layer to prevent leakage. At the base, the reactor hall has a 
diameter of 25m. At the transition from cone to sphere the diameter is 23m. The highest 
point is 28m above the floor level (Figure 1-2 and Figure 1-3). 

The reactor hall has three entrances. There is one door for trucks; opening of this door is 
only allowed during reactor shut down (RSA protected). And there are two air locks for 
personnel entrance; one is situated on the ground floor and one at 10. 5m above the floor 
level. 

At 17m above floor level a polar crane is installed. Both tail ends are on wheels and placed 
on a rail track that is part of the wall of the reactor hall. The crane is equipped with two 
electrical hoists: one with a maximum load up to 15 tonnes force and one with a maximum 
load of 1.6 tonnes force. Both hoists have remote control. 
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1.3.6 Control room and instrumentation 

The original control room, which is replaced by a new one, is still attached to the reactor hall 
wall on the inside at an elevated level of 10.5 m, facing in west direction. The present 
control room is located outside the reactor hall at the same elevation. The control room 
houses the instrumentation for safe operation and control of the reactor. Figure 1-9 shows 
a.o. the lay-out of the control room. 




Figure 1-9: lay-out of reactor hall including the control room building (Yegelkamer', RK) 
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The HOR instrumentation fulfils the following functions: 



• Protecting the reactor process through the reactor protection system; 

• Controlling the reactor process through the reactor control & operating system; 

• Reporting data and deviations in the operational status through the reporting and 
alarm system. 

The reactor protection system prevents the reactor attaining an unsafe condition by initiating 
the following actions: 

• Reactor Scram (in Dutch: Reactor Snel Afschakeling, RSA): all the control rods fall 
down simultaneously and the reactor is stopped immediately; 

• Pool Isolation (in Dutch: Bassin Isolatie, BIS): all the isolation valves of the primary 
cooling system and the water clean-up and make-up system close; 

• Isolation of the Reactor Hall (in Dutch: Reactorhal Isolatie, RIS): all the gastight 
isolation valves of the reactor containment system, see 1.1.7, close. 

Scram and/or isolation actions are initiated when safety limits are exceeded. Redundant 
(identical instrumentation) or diverse (different means) systems assure reliable operation of 
the protection system using a (1 out of 2, 3 or 4) or (2 out of 4) configuration. Figure 1-10 
presents the combination of signals that trigger those actions. 

The reactor control & operating system controls the nuclear fission process, the reactor 
cooling system and the auxiliary systems. Three limiting actions prevent interfering of the 
reactor protection system: 

• Automatic running down of the control rods (in Dutch: Automatisch Indrijven Staven, 
AIS): all control rods are slowly moved down to reduce power until the triggering 
event (pre limit for RSA signal) is restored; 

• Reactor operation locking system (in Dutch: Reactor Bedrijfs Vergrendeling, RBV): 
the reactor is not in an unsafe condition but normal operating conditions are not met 
which results in a scram; 

• Reactor start interlocking system (in Dutch: Reactor Start Vergrendeling, RSV) 
prevents start of the reactor when certain start-up conditions are not met. 

Initiation of these actions results from singular signals, e.g. AIS will be initiated on: 

• Tprimary > 52 °C at inlet of the heat exchanger, OR 

• Tpool sectionl > 40 °C. 

The reporting and alarm system reports when deviations in the operational status occur and 
when necessary an alarm signal is generated. Deviations are announced through lights on 
the operation panel and are also registered on the process computer. 
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Figure 1-10: signals of the reactor protection system 
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1.3.7 The ventilation system 

The ventilation system and the reactor hall form the reactor containment (see figure 1.11). 
The functions of the ventilation system are: 

• To refresh the air of the reactor hall; 

• Creating and maintaining the under pressure of the reactor hall 

To protect the reactor hall against exceeding the limits of under-(lkPa) and 
overpressure (lOkPa) a water seal is installed between the inlet duet of the 
ventilation system and the reactor hall; 

• Controlled disposal of the airborne radioactivity 
Filtering of the incoming and outgoing air: 

o Inlet flow is filtered by a dust filter to prevent pollution of the reactor hall by 
intake of dust; 

o Outlet air is filtered by high efficiency (HEPA; efficiency of 99.95% for 
particles larger than 0.3um) filters to prevent release of radioactive material 
that is produced and/or released from the reactor into the reactor hall. 

• Heating of the incoming air; 

• Containment isolation/recirculation. 

In case the concentration of radioactive materials in the ventilation outlet flow exceeds 
prescribed limits, the containment isolation valves will be closed. Internal recirculation of air 
can be started manually (in non-LOOP conditions). 

Due to safety aspects the active components of the ventilation system, such as ventilators 
and isolation valves are redundant. The ventilation system is independent of the reactor 
isolation system (RIS). 
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Figure 1-11: the reactor containment 
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1.3.8 Water clean-up and make-up system 

The Reactor Institute Delft has two water supply systems: a general municipal water supply 
and a demineralised water supply. Both water supplies come from the public water supply 
system. Arrangements are made to prevent flow reversion from the RID water supply system 
to the public water supply system. For the benefit of the HOR, municipal water is only used 
in the secondary cooling circuit system. For the primary system demineralised water is 
produced from municipal water by using ion exchange filters. Furthermore demineralised 
water is supplied to separate taps in the reactor hall, labs and workshop. Figure 1-12 
presents the diagram of this system 

Radioactive and non-rad ioactive impurities in the primary water system are continuously 
removed by ion exchange filtering (water recycling system, Figure 1-12). Subsequently, the 
purified water is lead back to the pool to compensate for loss of water through evaporation. 
Ion exchange filtering is also applied to demineralised water of the beam tubes. 

When work needs to be carried out inside the reactor pool, it can be necessary to empty one 
of the sections of the pool. Water from the section can be stored in the appropriate storage 
tank (Tl). Waste water from the labs is stored in other storage tanks. When the activity of 
the water is below the exemption limit the water is discharged, otherwise the waste water is 
condensed and the residue is treated as radioactive waste. 

Ultimately, in case of loss of pool water and lack of municipal water supply the storage tank 
Tl can be refilled rapidly by connecting the tank to fire fighting system with a connection 
(pipe). 




Figure 1-12: the water clean-up and make-up system 
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1.3.9 The electrical power system 

The Electrical Power System (EPS) contains three sections fed by the public grid. In case of 
loss of off-site power parts of these sections are fed by the diesel generator. Emergency 
lighting and instrumentation are also fed through an uninterrupted power supply (batteries). 

An onsite 10 kV station, fed by the public grid, supplies the RID transformers which are 
located on the RID site. These transformers supply the main distribution box, which in turn 
supplies several distribution cabinets in the institute. The internal electricity grid provides 
400 V AC and 230 V AC. 

Figure 1-13 presents the basic diagram of the network, whereas the parts also fed by the 
diesel generator are in red. Distribution cabinets numbers are displayed in the boxes 

From the safety point of view an emergency power supply is not necessary because reactor 
shut down and residual heat removal are independent of power supply. When there is a 
power failure a RSA (Reactor Scram), a RIS (Reactor Hall Isolation) and BIS (Pool Isolation) 
take place. However power, supplied by a diesel generator, ensures that a/o information is 
available and the reactor hall is easy accessible. 

Main 

Distribution Distribution 

Boxes Boxes 
1 m 




Figure 1-13: Diagram of the electrical power system 
1.3.10 Experimental facilities 

The HOR is provided with a large number of experimental facilities: beam tubes, a Big 
Sample Neutron Irradiation System (BISNIS) inside the thermal column, in core irradiation 
facilities, pneumatic rabbit systems and an experimental grid plate. 

There are 10 beam tubes: AR, AM, AL, Rl, R2, R3, LI, L2, L3 and DR-DL (Figure 1-14). The 
beam tubes are constructed of an aluminium inner and outer tube, surrounded by a stainless 
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steel tube that is imbedded in the concrete biological shield (Figure 1-15). The aluminium 
outer tubes are connected to the stainless steel tube by swivels. From the open top side of 
the pool the aluminium outer tubes are visible. The dimensions of the inner aluminium tubes 
are adjusted to the experiment that is placed inside the beam tube. 

The thermal column is situated at the north-west side of the core. The thermal column is a 
cupboard constructed of steel and aluminium. On the side of the core an aluminium window 
of 1.4 by 1.4 m is installed. Above and below the DR-DL beam tube aluminium air boxes are 
installed. A nitrogen box is installed between the core and the thermal column that can be 
filled either with nitrogen or water in order to vary the neutron flux in the direction of the 
thermal column. On the inside of the thermal column, a boral plate lining is installed in order 
to reduce activation of the construction materials. In order to reduce the activation of the 
stainless steel lining a cadmium plate is installed. 

On the side of the reactor hall the thermal column is enclosed by an electrically driven 
mobile door which is constructed of barite concrete. On the inside the door is covered with 
lead and boral plates. The space around the BISNIS is filled with graphite blocks. For extra 
shielding on the outside four concrete blocks are placed around the thermal column. 

On the southern side of the large pool section the dry irradiation room (DBR) is situated. For 
this DBR there is an open space of 2.4 m by 2.4 m in the concrete wall of the pool. The open 
space is enclosed by an aluminium window. For irradiation in the DBR the core needs to be 
moved to the large pool section. However this facility has never been used. 

The HOR is provided with two in-core irradiation facilities: the Bigbebe and the Smallbebe. 
Both are positioned in a beryllium reflector element. The Smallbebe consists of an outer tube 
containing two aluminium transport tubes. The inner diameter of the transport tubes is 16 
mm. The Bigbebe consists of an outer tube containing one aluminium transport tube. The 
inner diameter of the transport tube is 40 mm. As the outer tubes of both in-core irradiation 
facilities are open there is no need of a counterweight. 

There are four pneumatic rabbit systems (BP1 to BP4). Samples packed in polyethylene 
rabbits are transported to the core by a compressed air system. The sending/receiving 
station of BP1 is located in the reactor hall. The sending/receiving stations of the other rabbit 
systems are located in a laboratory outside the reactor hall. Leakage of pool water through 
this system is prevented because the guiding tubes pass the pool walls on top. 

Finally the experimental grid plate is fixed to the core. Experiments and irradiation facilities 
can be placed onto this plate 
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Figure 1-14: Overview of the beam tubes 
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Figure 1-15: Construction of a beam tube 

Next to the reactor pool, inside the reactor hall a subcritical assembly has been installed. 
This assembly is applied for educational purposes. The following training exercises can be 
performed: 
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• Static determination of the multiplication factor by the so-called critical assembly 
approach 

• Axial and rad ia I neutron flux measurements 

• Source term experiments 

• Neutron noise experiments like Feynman-a, and correlation measurements. 

The Delphi assembly consists of two vessels on top of each other. The lower vessel is made 
of stainless steel and is filled with de-mineralized water before the start of an experiment. 
The upper acrylic air-filled vessel is used to store 168 fuel pins (maximum) that can be 
lowered one by one into the steel vessel to perform an experiment. Below the steel vessel, a 
shielding box is positioned containing a Cf-252 neutron source that can pneumatically be 
inserted to its experi mental position. 

The 168 fuels pins are positioned in a square lattice of 13x13 positions; the arrangement 
(pitch) of the lattice is such that k eff will not exceed a maximum of 0.92. 

Dose rates for the scientist performing an experiment with the source in its experimental 
position is less than 6.5 uSv/hr at the outer surface of the steel vessel; trespassers are 
subjected to a radiation dose rate of less than 1 uSv/hr when the source is in its shielding 
box. 

1.3.11 Auxiliary systems 

1.3.11.1 Fire detection/fighting 

Fire detection and alarm equipment is installed in the reactor hall and auxiliary building. Fire- 
fighting equipment, hand extinguishers as well as hoses are available. Appendix A shows the 
positions of this equipment for related floors. 

1.3.11.2 Central Measuring and Registration System (CRS) 

The radiation and activity levels of all the building of the RID are monitored by the Central 
Measuring and Registration System (CRS) of the Radiation Protection department (SBD). 
Monitors are a/o installed in the reactor hall and auxiliary building, see appendix A. The CRS 
is not coupled to the reactor control & operating system and the reactor protection system. 

1.3.11.3 Communication systems 

For fast and efficiënt communication between the control room and supporting staff and 
services, there are several communication systems in operation: 

• Telephone lines and GSMs; 

• Intercom installation: the central station is based in the control rooms and several 
stations are installed in offices through the RID complex; 
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• A sound system which is operated from the reception; 

• A pager system; 

• Several departments including operations and technical services have walkie-talkies; 

• An acoustic alarm system in case of emergency. 

1.3.12 Nuclide inventory 

For the nuclide inventory the following contributors can be listed: 

• The reactor and pool: 

that include core, spent fuel, activated/contaminated water and activated parts of 
reactor systems 

• The experiments: 

that include targets irradiated by the reactor 

• Remaining sources: 

o the Delphi assembly 

o "open" sources, independent of the reactor 

o "closed" sources, independent of the reactor 

The inventory of fission products in one irradiated fuel element, after long residence in the 
core, is 5722 TBq. The concentration of 1-131 in the primary cooling water was 33 kBq/m 3 at 
a maximum in 2011. The maximum activity produced by irradiation for 2011 was 165GBq. 

"Open" sources are rated at 52 TBq; the "closed " sources are Co-60 sources classified 
according IS063424 and are rated at 75 TBq. The Delphi assembly encloses a shielded Cf- 
252 source of maximum 18.5 MBq, while the fuel itself hardly includes any fission products 
(approx. 2GBq in total). 

From this it can be concluded that the remaining inventory of nuclides is negligible compared 
to the inventory of the core. 

1.4 Systems for providing or supporting main safety functions 

The following safety functions are defined: 

• Reactivity control 

Shutting down the reactor and maintaining it in a safe shut down state for all 
operational states and Design Base Accidents (DBAs); 

• Cooling 

Providing for adequate removal of heat after shut down, in particular from the core, 
including in DBAs' situations; 

• Confinement 

Confining radioactive material in order to prevent or mitigate its unplanned release to 
the environment. 
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Key support functions are: 

• Electrical power supply; 

• Heat transfer to the ultimate heat sink. 

1.4.1 Reactivity control 

In this section only the reactivity control of the core and the stored fuel elements will be 
described. Experiments in the HOR do not contain fissile material. Therefore reactivity 
control does not apply for the experiments. 

Reactivity addition or reduction by experiments that will be placed in or nearby the core are 
taken into account at core design including an efficiency check of the reactivity control 
system. The maximum reactivity of experiments is limited according to the OLC. 

1.4.1.1 Reactivity control system of the HOR 

Reactivity control of the HOR includes the combination of reactivity characteristics of the 
core and of the reactivity control system. 

The reactivity control system of the HOR has three functions: 

• The control of reactor power during operating conditions; 

• Limit power increase in case of transients to prevent fast shut down; 

• Fast shut down of the reactor (scram5) when prevention fails or accident conditions 
occur. 

The reactivity control system consists of 4 control rods. These rods are connected to their 
driving mechanism by an electromagnetic device. Switching off the current results in gravity 
driven (passive safe) insertion of the rods into the core. The impact of the insertion relies on 
the neutron absorption capacity of the B 4 C material of the rods. 

The function of the reactivity control system is twofold: controlling the reactor power and 
protection (scram). 

For reactivity control the following design requirements apply: 

• The excess reactivity of the core should be less than 6 %; 

• Shut down of the reactor should be assured by insertion of two of the least reactive 
control elements, while the remaining two are completely withdrawn. The shut-down 
margin of both these rods is checked at the start of every core cycle of the reactor 
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(period between refuelling of the core). This assures shut down of the reactor even 
with two rods stuck; 

• Reactivity addition should be limited as it is related to the limited insertion and 
withdrawal speed. Safety limits with regard to reactor periods should not be 
exceeded; 

• In scram situations, drop time of the rods should be less than 0.65s; 

• The temperature coëfficiënt of fuel and moderator should be negative for the total 
power range of the reactor. 

A reactor scram (RSA) means cutting of the exciter current of the magnet coils. A scram can 
be initiated when deviations from normal operation occur such as: 

• Loss of primary pump; 

• Spurious withdrawal of control rods; 

• Loss of pool water; 

• Closure of the pool isolation valves; 

• Release of fair amounts of radioactive materials; 

• Vertical or horizontal acceleration forces on the control rods, greater than their 
electromagnetic hold force. 

Those deviations are detected by diverse means. In case diversity of detection systems is not 
applicable, redundancy of systems is applied. Various combinations of signals then will result 
in shut down (RSA) of the reactor. For a listing of these signals and the applicable 
combinations see Figure 1-10. 

For instance, loss of the primary cooling pump will cause an RSA due to the combination of 
signals that indicate: 

• loss of primary coolant flow; 

• deviation of pressure difference at primary and secondary side of the heat exchanger 

• (redundant) loss of position indication of the (primary system) suction head; 

1.4.1.2 Reactivity control of stored fuel 

Distinction is made between storage of fresh fuel elements and spent fuel elements: 

Fresh fuel elements 

Fresh fuel elements are stored in a dry vault. This vault is a secured cell that contains a 
storage rack with 30 positions. 28 Positions are available for storage of a fresh fuel element. 

It is shown that the arrangement of the rack is such that k eff of this vault will not exceed 
0.95 even in case it is flooded by clear (non-borated) water. 
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Spent fuel elements 



Due to their radioactive inventory, spent fuel elements have to be stored in the pool section 
1 or 2, see Figure 1-7. For this storage, 12 racks that are fixed to the pool wall and 3 mobile 
racks are available. Four fixed racks are placed in section 1, the remaining racks are situated 
in section 2. 

A fixed rack contains 5 positions for storage of an element; the mobile racks have two rows 
of 8 positions each. AH racks are covered by a water layer of approx. 6 m, mainly for 
shielding. 

The design of the racks meets the requirement that k eff of the racks and the pool will not 
exceed 0.95 on OLC conditions that restrict storage areas in the neighborhood of the core. 
OLC also does not permit transport of mobile racks in case they are loaded with spent fuel. 

1.4.2 Heat transfer from reactor to the ultimate heat sink 

ENSREG defines the ultimate heat sink (UHS) as a medium to which the residual heat from 
the reactor is transferred. In some cases a plant has a primary UHS, such as the sea or a 
river, supplemented by an alternate UHS, for example a lake, a water table or the 
atmosphere. 

Characteristic for those media is that they are almost infinite and in their bulk not affected by 
the heat discharge. 

Based on the ENSREG definition the ultimate heat sink of the HOR is provided by the open 
air. Ultimately the heat produced by the reactor during power operation as well as the 
residual heat during plant shut down are discharged to the open air through the primary and 
secondary cooling system of which the cooling towers are the last part of the cooling chain. 

An alternate ultimate heat sink, as it is indicated by ENSREG, does not exist at the RID site. 
However the pool, although ultimately not infinite, provides alternative cooling i.c. storage of 
the residual heat and can be considered as back up for the UHS; it will be dealt with under 
this denominator. 

1.4.2.1 Existing heat transfer means 

The reactor cooling system of the HOR transfers the heat generated by the reactor core to 
the environment. It consists of the primary and the secondary cooling system. Both systems 
are "open" systems as the initial part of the primary system, the pool, and the end part of 
the secondary system, the cooling towers, are open to the air (containment and open air 
respectively). Figure 1-8 presents the lay-out of both systems. 

As indicated before, for power operation up to 500kW (nominal) and 750kW (maximal) 
cooling by natural circulation is permitted and feasible. For power operation at a higher 
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power level up to 2 MW (nominal) and 3 MW (maximal, with a time constraint of 1 hour per 
day) forced cooling is necessary. In shut down conditions dissipation of decay heat into the 
pool is allowed and is normal practice during the weekends or longer periods of shut down. 

The primary system comprises in succession: 

• The pool 

The pool absorbs the heat produced by the core. 

It is supported by the primary water clean-up system that contains circulation pumps, 
ion-exchangers, drain/supply tanks and a water make-up system to provide 
demineralized water. It is noticed that water can be pumped or even drained from 
the supply tank to the pool; 

• 777e core 

For its confinement function and heat production; 

• The suction line and suction inlet 

During forced cooling the suction inlet is lifted to the pedestal of the core by the 
suction force of the primary pump. At failure or stop of this pump the suction inlet 
will sink back by gravity into the "chair"to allow cooling by natural circulation; 

• The pool isolation out/et valves 

The valves provide isolation by closing off the outlet line of the pool during specific 
operational occurrences; 

• The primary pump 

The primary pump provides circulation of the coolant; 

• 777e control valves 

The flow control valves, placed at inlet and outlet of the heat exchanger, control 
primary coolant flow in accordance with power operation and assure that the 
pressure at the primary side of the heat exchanger is lower than the pressure at the 
secondary side; 

• 777e heat exchanger 

The heat exchanger transfers heat from the primary system to the secondary system; 

• 777e pool isolation inlet valves 

The valves provide for pool isolation by closing off the inlet line of the pool during 
specific operational occurrences; 

• 777e diffusor 

The diffusor distributes inlet water in the pool and provides a smooth internal pool 
flow. 

The secondary system comprises in succession: 

• The secondary pump 

The secondary pump recirculates cooled water from cooling towers to the heat 
exchanger; 
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• 777e heat exchanger 

The heat exchanger removes heat from the primary system. It provides the barrier 
between primary water that might be slightly contaminated and secondary cooling 
water, which is not contaminated, and which is partly evaporated and released to the 
open air; 
The control valves 

The control valves are placed at inlet and outlet of the heat exchanger to control 
secondary coolant flow in accordance with power operation and to assure that the 
pressure at the secondary side of the heat exchanger is higher than the pressure at 
the primary side; 
777e cooling towers 

The cooling towers provide cooling of the secondary cooling water by evaporation of 
a part of that water in combination with forced convection of air. 
Support systems of the cooling towers are: 

o Sprays; 

o Fan system; 

o Water supply system; 

o Drain system; 

o Chemical control system; 

o Frost prevention pump: 

In case the reactor is shut down during wintertime, this pump provides 
circulation of the secondary water to prevent freezing. 

1.4.2.2 Lay out information on the heat transfer chains 

The piping of both primary and secondary system is made of stainless steel to prevent leaks. 

The primary system (including the heat exchanger) is placed in the pipe-basement almost 
directly beneath the reactor pool. Connecting piping of the secondary system passes also the 
pipe-basement. Figure 1-16 shows a picture of the pipe basement. The pump-building, 
situated below both cooling towers, houses the remaining parts of the secondary system. 

The water treatment and water make-up systems are installed in a room next to the pipe- 
basement. 
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Figure 1-16: Pipe basement 

1.4.2.3 Possible time constraints for availability of heat transfer chains 

There are no alternative cooling chains available; decay heat can be dissipated into the pool. 

1.4.2.4 AC power sources and batteries for each chain 

The electrical power supply to the HOR is provided by the following systems: 

• the public grid through its lOkV sub-station; 

• the diesel generator (in case of loss of off-site power); 

• the uninterrupted power supply system (batteries); 

In case of loss of off-site power the reactor will be shut down automatically and decay heat 
will be dissipated into the pool. Therefore, to assure heat removal of the core, no emergency 
power is needed. As a result the main circulation pumps, the ventilation system of the 
cooling towers, as well as the water clean-up and make-up system are not fed by the diesel 
generator system. For operational reasons support systems like the frost prevention pump 
and the air-locks are connected to that diesel generator. 

1.4.2.5 Need and method of cooling equipment 

Distinction is made between operation at a power level less than 750 kW and a power level 
beyond 750 kW. 
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For operation below 750 kW cooling is performed by heat transfer (convection) to the pool 
water that causes natural circulation through the core. Operation time is limited by the 
temperature constraint of 40°C of the pool water. 

For operation at a power level beyond 750 kW up to 3MW forced circulation is needed to 
remove the heat from the core and for transfer to the ultimate heat sink. This plant state 
requires operation of the entire reactor cooling system. Heat is transferred from the core to 
the primary cooling system and from the primary to the secondary cooling system by 
convection. Heat is finally released to the environment through the cooling towers by 
evaporation of the secondary cooling water in combination with forced convection of air. 
Usually the reactor is operated at 2MW due to the cooling capacity, or at 3 MW for one hour 
per day. 

1.4.3 Heat transfer from spent fuel pools to the ultimate heat sink 

Spent fuel is stored in the pool without any additional confinement. This means that decay 
heat generated by spent fuel is dissipated directly into the pool that is part of the primary 
system. 

Therefore, methods and systems for heat removal of the spent fuel are the same as for core 
cooling, see 1.4.2. 

1.4.4 Heat transfer from the reactor containment to the ultimate heat sink 

1.4.4.1 Existing heat transfer means 

The main tasks of the ventilation system are refreshing air, heating during wintertime, 
controlling in- and outlet of (radioactive) airborne particles and isolation of the containment 
(reactor hall) during specific operational occurrences. Heat removal from the reactor hall is 
only performed by the refreshment action or by convection of the hall outer wall to open air. 
Inlet air is not cooled, nor are additional internal coolers installed. 

1.4.4.2 Lay out information on the heat transfer chains 

The containment system is described in 1.3.7. 

1.4.4.3 Possible time constraints for availability of heat transfer chains 

Not applicable. 

1.4.4.4 AC power sources and batteries for each chain 

Not applicable for cooling purposes. 
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1.4.4.5 Need and method of cooling equipment 

Not applicable. 

1.4.5 Confinement of radiactivity 

1.4.5.1 Existing means of confinement 

The ventilation system and the reactor hall form the reactor containment to reduce the 
release of radioactive material to a minimum by: 

• Control and filtering of (radioactive) airborne material at inlet and outlet of the 
ventilation system; 

• Isolating the reactor hall in case the concentration of radioactive material exceeds 
discharge limits by closing the isolation valves of the ventilation system; 

• Internal circulation and filtering of the internal air in case isolation is applied. 

1.4.5.2 Lay out information of the confinement system 

System layout of the reactor containment is presented in Figure 1-11 

At the inlet (open air to reactor hall) the system contains the following components: 

• The inlet filter 

The inlet (dust) filter prevents the reactor hall for pollution by dust; 

• The heater 

Inlet air can be heated during cold periods; 

• The isolation valves (two in /ine, redundant) 

These valves, operated by compressed air in a fail-safe mode, isolate the reactor hall 
by closing the inlet line during specific operational occurrences; 

• Inlet ventilation 

This system consists of two strains in parallel that include each one ventilator 
surrounded by two valves. The inlet ventilation flow is controlled by the ventilator 
speed; 

• The water seal 

This seal protects the reactor hall from exceeding limits for underpressure (1 kPa) 
and overpressure (lOkPa). 

At the outlet (reactor hall to open air) the system contains the following components: 

• A HEPA filter 

Outlet air is filtered by a high efficiency (HEPA; efficiency of 99.95% for particles 
larger than 0.3um) filter to prevent release of radioactive material that is produced 
and/or released from the reactor into the reactor hall; 



56/162 



CSA-HOR 25-04-2013 v1.1 



• Out/et ventilation 

This system consists of two strains in parallel that include each one ventilator 
surrounded by two valves. The outlet ventilation flow is controlled by the speed of 
the outlet ventilator; reactor hall pressure control results from tuning of inlet and 
outlet ventilator speed; 

• The isolation valves (two in line) 

These valves, operated by compressed air in a fail-safe mode, isolate the reactor hall 
by closing the outlet line during specific operational occurrences; 

• Detection system s 

Detection systems measure radioactivity in the ventilation flow and initiate reactor 
hall isolation in case release limits are exceeded; 

• Isolation bypass 

One valve provides a bypass of the isolation valves in the outlet, to additional protect 
the reactor hall for over pressurization and disorder of the water seal. 

In addition to this system a recirculation line is put in place that connects the ventilation 
system between outlet ventilation and outlet isolation valves at one side and the ventilation 
system between inlet isolation valves and inlet ventilation at the other side. In this way 
recirculation including filtering can be performed during reactor hall isolation. 

1.4.5.3 AC power sources and batteries for each chain 

Ventilators and valves of each chain are supplied by the normal electrical power system; as 
they are not connected to the grid that is powered by the diesel generator these components 
will not be available during loss of off-site power situations. 

1.4.5.4 Need and method of confinement 

Two plant states can be distinguished with regard to confinement namely: 

• Normal operation; 

• Reactor hall isolation. 

Normal operation 

In normal operation the reactor power can vary from shut down state to full power while the 
ventilation system operates normal. This means that at inlet and outlet the air flow is filtered 
by respectively the inlet filter, that is a normal dust filter and the outlet filter, a HEPA filter 
with an efficiency of 99,99% for airborne particles. 

Reactor hall isolation 

When the airborne radioactivity concentration is too high a RSA and a RIS occur so the 
reactor scrams and the gastight isolation valves of the in- and outlet close. 
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Isolation of the rabbit systems 

The rabbit systems that penetrate the wall of the reactor hall are equipped with valves that 
can be closed for reactor hall isolation. 

1.4.6 AC power supply 

1.4.6.1 Off-site power supply 

1.4.6.1.1 Reliability of off-site power supply 

The off-site power supply in the Netherlands is in general reliable. The mean failure 
frequency of the lOkV power supply to a costumer in the Netherlands is 0.27 per year. The 
mean duration of a power supply failure is 70 minutes. Plant specific data for the HOR is not 
available; therefore, this generic figure is also applicable for the loss of off-site power of the 
HOR. 

1.4.6.1.2 Connection of the plant with external power grid 

The main power supply is obtained from a 10 kV station (public grid) which is located just 
outside the borders of the RID site and is transported to the transformers which are located 
on the RID site. 

Figure 1-13 presents the diagram of the network. 

1.4.6.2 Power distribution inside the plant 

1.4.6.2.1 Main cable routings and power distribution switchboards 

The transformers supply the main distribution center, which in turn supplies several 
distribution centers in the institute. The internal electricity grid consists of a 400 V AC 
network and a 230 V AC network. These networks are divided into three sections that on 
their turn enclose overall 24 bus bars. From these bars all consumers are fed. 

1.4.6.2.2 Lay-out, location, and physical protection against internal and external hazards 

Transformers are located in the "transformer ruimte", see Figure 1-17. There are no extra 
precautions taken to protect these devices against hazards. 

Figure 1-17 shows the lay-out of the internal electricity supply equipment. 

1.4.6.3 Main ordinary on-site source for back-up power supply 

In terms of reactor safety, back-up power supply is not needed. At power failure a RSA 
(reactor scram), a RIS (reactor hall isolation) and a BIS (pool isolation) are initiated. Safety 
functions are assured and require no electricity. 
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Nevertheless, in case of loss of off-site power parts of the three sections of the electrical 
power system will be fed by a diesel generator that is found in the generator building. 

Fuel is supplied to the diesel generator by a day tank of 0.65 m 3 with a minimum stock of 
0.5 m 3 , backed by a main tank of 1 m 3 also having a minimum stock of 0.5m 3 . Runtime of 
the diesel generator is approx. 6 hours at full load and minimum stock 6 . 

1.4.7 Batteries for DC power supply 

1.4.7.1 Description of separate batteries banks 

An un-interruptible power supply system (UPS) with batteries is available. lts design back-up 
time is 1 hour. 

1.4.7.2 Consumers reserved by each battery bank 

Basically the UPS is meant to provide un-interrupted power to the instrumentation and the 
emergency lighting for the short period at switch over from public grid to power supply by 
the diesel generator. 

1.4.7.3 Physical location and separation and protection from internal and 
external hazards 

Batteries for the un-interrupted power provision are located next to their consumers; like 
batteries that are included in instrumentation boxes or emergency lighting that is fed by its 
own batteries. 

1.4.7.4 Alternative possibilities for recharging each battery bank 

Recharging is possible when external grid or diesel generator are available. 
There are no alternative possibilities for recharging of the batteries. 



6 Stress test precondition to indicate operation time frame: minimum stock is available and will not be 
replenished 
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Figure 1-17: electric power supply equipment 



60/162 



CSA-HOR 25-04-2013 v1.1 



1.5 Scope and main results of Probabilistic Safety Assessments 



For its current license the HOR safety analyses report lists those events that were applicable 
at the time of the last license application. Probabilistic assessment is applied to categorize 
initiating events as design base accidents (DBA) and beyond design base accidents (BDBA). 
The latter are deemed highly improbable. 

For control of the consequential impact of operation of nuclear reactors in relation to those 
safety analyses, the Dutch nuclear regulator applies criteria that have to be met. 

For DBA this is related to doses criteria per event category. Categorization in this respect 
means classification in blocks of initiating frequencies of the events under consideration. For 
BDBA this is related to criteria for individual risk and risks to the society. 

For the HOR enveloping initiating events are selected for both DBA and BDBA groups, 
namely: 

1. for DBA 

blockage of cooling channels of a fuel element during power operation (due to 
multiple failure of blockage detection systems) resulting in fuel damage and finally 
releases to the environment; 

2. for BDBA 

Air plane crash, hitting the HOR and resulting in releases to the environment. 

For both initiating events accident sequences are developed resulting in the definition of 
source terms. 

For the DBA the impact of the source term is assessed with COSYMA, a probabilistic 
consequence assessment code. This code includes effects like: 

• Ingestion; 

• Inhalation; 

• Radiation of air borne radioactive materials; 

• Deposit; 

• Contamination; 

• Site characteristics like weather conditions, surrounding of inhabitants. 

For the BDBA the HOR is compared to other research reactors that assessed this event and 
determined its impact by application of COSYMA. 
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2 Earthquakes 

2.1 Design basis 

2.1.1 Earthquake against which the plant is designed 
2.1.1.1 Background 

The Netherlands have no earthquakes with devastating consequences, as the Netherlands 
are not at the edge of a tectonic plate (see Figure 2-1). 



Figure 2-1 : Overview of tectonic plates; source: KNMI 

Earthquakes are characterized by their magnitude on the Richter scale or by the intensity on 
the modified Mercalli Intensity scale (MMI) or the European Macro-seismic Scale (EMS). The 
magnitude on the Richter scale is a measure for the energy released by the earthquake. The 
intensity scales are based upon what people in the affected area feel and their observations 
of damage to structures around them. A rough comparison between the intensity (MMI) and 
the magnitude (Richter) for natural earthquakes is given in Table 2-1. The MMI and EMS 
scales are identical for the range of the Richter scale, up to MMI intensity IX. 
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Table 2-1: Comparison between MMI and Richter scale, valid at epicenter of natural earthquake 



Intensity 
(MMI or MMS) 


Observation 


Magnitude 
(Richter) 


I 


Feit by very few people; barely noticeable. 


1.0 to 2.0 


II 


Feit by a few people, especially on upper floors. 


2.0 to 3.0 


III 


Noticeable indoors, especially on upper floors, but may not be recognized 
as an earthquake. 


3.0 to 4.0 


IV 


Feit by many indoors, few outdoors. May feel like heavy truck passing by. 


4.0 


V 


Feit by almost everyone, some people awakened. Small objects moved and 
trees and poles may shake. 


4.0 to 5.0 


VI 


Feit by everyone. Difficult to stand. Some heavy furniture moved and some 
piaster falls. Chimneys may be slightly damaged. 


5.0 to 6.0 


VII 


Slight to moderate damage in well built, ordinary structures. Considerable 
damage to poorly built structures. Some walls may fall. 


6.0 


VIII 


Little damage in specially built structures. Considerable damage to ordinary 
buildings, severe damage to poorly built structures. Some walls collapse. 


6.0 to 7.0 


IX 


Considerable damage to specially built structures, buildings shifted off 
foundations. Ground cracked noticeably. Wholesale destruction. 
Landslides. 


7.0 


X 


Most masonry and frame structures and their foundations destroyed. 
Ground badly cracked. Landslides. Wholesale destruction. 


7.0 to 8.0 


XI 


Total damage. Few, if any, structures standing. Bridges destroyed. Wide 
cracks in ground. Waves seen on ground. 


8.0 


XII 


Total damage. Waves seen on ground. Objects thrown up into the air. 


8.0 or larger 



Seismicity of tectonic origin in The Netherlands is related to the Lower Rhine Graben and 
only observed in the south-east of The Netherlands. (see Figure 2-2). The most powerful 
earthquake was observed near Roermond in 1992 with an intensity of 7 on the EMS. 

Besides earthquakes of tectonic origin, earthquakes induced by the extraction of oil and 
natural gas are observed; mainly in the northern part of the Netherlands. Figure 2-2 
presents observed earthquakes in MMI magnitudes. Induced earthquakes are lighter, have a 
shorter duration and are more shock-like than natural earthquakes. 
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Figure 2-2: Earthquakes in the Netherlands, 1904-2004, magnitude in Richter Scale: source KNMI 

This assessment is based on historical data, the location of active faults and the damping of 
the soil. The seismic risk map of the Netherlands - presented in "A seismic zoning map 
conforming to Eurocode 8, T. Crook, (Figure 2-3) - is based on natural earthquakes observed 
in the Netherlands, Belgium and Germany. The induced earthquakes in the northern part of 
the Netherlands are not taken into account. The map shows the maximum expected seismic 
activity with a return period of 475 years, which corresponds with an exceedance frequency 
of 10% in a 50 year period. 

In the vicinity of Delft (within a 15 km radius) just one earthquake has been observed since 
1904, see Figure 2-2. This earthquake had an intensity of 2.5 on the EMS. De seismic risk 
map (Figure 2-3, left hand side) shows that in the vicinity of Delft the maximum expected 
earthquake has an intensity of 4.5 - 5 on the EMS. This corresponds with a ground peak 
acceleration of 0.22 m/s 2 
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Figure 2-3: Seismic risk map of the Netherlands; left hand: intensity (EMS); right hand: peak acceleration (zones 
A, B, C and D , respectively 0.1, 0.22, 0.5 en 1.0 m/s 2 )7. 

In areas with low seismic activity a ground peak acceleration of at least O.lg (1 m/s 2 ) has to 
be taken for nuclear facilities according to IAEA Safety Standards Series No. NS-G-3.3: 
"Evaluation of Seismic Hazards for NPPs". 

2.1.1.2 Characteristics of the design base earthquake (DBE) 

According to the Dutch building code (TGB 1990) earthquake loads can be accounted for as 
exceptional loads. However, the code provides insufficiënt data to quantify the earthquake 
load. Therefore, earthquake loads are normally neglected. The Dutch building code has been 
replaced by the Eurocode 8 in 2010. Eurocode 8 addresses seismic loads. For the application 
of Eurocode 8 the required data to quantify the seismic load have to be taken from the 
country specific appendix. NEN has not yet published the Eurocode 8 appendix for the 
Netherlands. Therefore, the impact of earthquakes on buildings cannot be addressed within 
the rules of Eurocode 8 in the Netherlands. This implies that although the present building 
code gives guidance on the design of earthquake resistant buildings, the data lack to 



7 Source: Crook, T., A seismic zoning map conforming to Eurocode 8, and practical earthquake 
parameter relations for the Netherlands. Geologie en Mijnbouw, 1996. 75: p. 11-18. 
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determine the design base earthquake . In conclusion: there is no DBE defined nor can be 
defined for the HOR. 



2.1.1.3 Methodology used to evaluate the design base for the earthquake 

Since no design base earthquake is defined, an evaluation is not possible. 

2.1.1.4 Conclusion on the adequacy of the design base for the earthquake 

Conclusions on the adequacy of protection against earthquakes cannot be drawn based on 
the previous paragraphs. The adequacy of the resistance against earthquakes will be 
considered in the next sections, where the impact of earthquakes on the basic safety 
functions is analysed. 

2.1.2 Provisions to protect the plant against the design base earthquake 
2.1.2.1 SSC's required for achieving safe shutdown state 

The current safety philosophy behind the design of nuclear power plants against earthquakes 
did not exist at the time the HOR was designed and the building started in 1958. The overall 
safety philosophy was a conservative design with simple technical solutions and using as 
much as possible natural mechanisms to control the system processes after incidents and 
accidents (inherently safe approach). The protection of the HOR against incidents and 
accidents, including earthquakes, is based on the following four levels of defence (defence in 
depth principle): 

1. Prevention of incidents through the conservative reactor design, reliable systems, 
quality assurance and a well-considered, plant operation laid down in procedures 
and instructions; 

2. Detection and correction of plant operation parameters by extensive 
instrumentation before the system parameters exceed the operational limits. Safety 
(relevant) variables are detected by redundant and independent sensors for the 
reactor protection system RPS, the reactor control system and the alarm systems. 
Next to the use of interlocks in the normal process control, an additional layer 
between reactor control and RPS is used. This protection layer reduces the reactor 



Design earthquake: The earthquake for which the safety systems of a nuclear reactor are designed 
to remain functional both during and after the earthquake, thus assuring the ability to shut down 
and maintain a safe configuration in the nuclear installation. 
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power, in order to bring the process back within the limits of the control loop. This 
additional layer limits the number of scrams by the RPS. Reactor control and RPS 
are independent systems; 

3. Accident management through the safety systems. Before system parameters 
exceed the safety limits the safety systems will take corrective actions to control the 
accident: o.a.: SCRAM (Reactor Snel Afschakeling, RSA), Pool isolation (Bassin- 
Isolatie, BIS) en reactor building isolation (Reactorhal-Isolatie, RIS); 

4. Mitiqation of the effects of an accident for the public and the environment as laid 
down in the "bedrijfsnoodplan en instructies". 

Based on this approach the following three basic safety functions of the reactor are 
guaranteed (see chapter 1) under all levels of defence: 

1. Control of reactivity. In the reactor building the reactor core and spent fuel are 
present plus the (remains) of experiments. Main systems are the control rods, their 
drive mechanisms and the reactor protection and control system to control the 
reactivity of the core. Spent fuel is kept in a safe subcritical configuration by design 
and procedures in the reactor pool; 

2. Cooling: The reactor core and spent fuel need cooling. The main cooling system 
consists of the forced or natural convection9 flow open loop primary cooling system, 
the open secondary cooling loop and the air cooling towers. Decay heat removal is 
performed by convection cooling with pool water; 

3. Confinement Confinement is provided by, in succession the fuel matrix, the fuel 
cladding, and the containment building. The primary system boundary plus the pool 
provide a semi confinement function placed between the fuel matrix and the 
containment. 

1. Control of reactivity: The HOR has 4 control rods that are coupled to their drive trains 
by means of an electromagnet. Interrupting the electrical current causes the rods to drop by 
gravity. Two out of four rods are needed to shut down the reactor. Guide tubes ascertain 
that the rods drop without hindrances into the core. The scram function is tested weekly, as 
this is the normal way to shut down the reactor. The electrical current through the 
electromagnets is set at such level that the weight the electromagnets can hold is 9 kg. A 
control rod weighs 5 kg. This means that the rods- using the relation F = m*a - will drop at 
a downward vertical acceleration level of 17.7 m/s 2 (a = 9*9.81/5). Using the IAEA 
guidelines in applying a factor of 1.5, this vertical acceleration corresponds with a ground 
peak acceleration of 11.8 m/s 2 . However, the construction of the holding mechanism is such 
that a small horizontal movement of the control rods is possible. A horizontal seismic 



9 Operation mode with natural convection is limited to 750 kW core power 
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acceleration will result in the development of a gap between the holding surfaces of the 
electromagnet and the control rod. This gap will decrease the magnetic force substantially 
and thus resulting in a drop of the control rods at a much smaller earthquake. A more 
detailed evaluation should be performed to determine the seismic load at which the control 
rods drop. On the other hand the large stability of the pool and the core configuration under 
earthquake conditions guarantees to a high degree that the scram function will not be 
jeopardised and shut down will be successful. 

2. Decay heat removal: The decay heat removal system is a totally passive system, that 
requires neither motive nor control power. The moment the primary pump is stopped the 
suction head of the primary suction line drops to its rest position by gravity. A gap between 
the suction head and the core support plate is created and convection cooling starts 
(automatically). This convection cooling is the Standard way of decay heat removal after shut 
down of the reactor and is as such sufficiënt to prevent core damage (see paragraph 1.3.4). 
Even in case the suction head does not drop because the cantilever system is damaged by 
the earthquake, convection cooling with a downward flow at the sides of the core and 
upward flow in the centre is sufficiënt to cool the core. Additional water can be drained from 
the storage tank to the pool. The storage tank can be supplied by water from the fire 
fighting network. Means to this end are available. An instruction is not available and should 
be drafted. 

3. Containment: Containment function is guaranteed by pool isolation valves (BIS) and 
reactor building isolation valves (RIS). Both valve types are fail-safe. The BIS valves are 
spring return valves. The RIS valves are closed by compressed air from a buffer. In case of a 
power failure these valves will be closed automatically. 

2.1.2.2 Main operating contingencies 

As stated above, the principle of "defence in depth" is used. Safety is guaranteed by 
measures and / or systems on different levels. Failure of a measure or system on one level is 
compensated with one on the next level. The main characteristics are a robust design of the 
reactor, the reactor pool and the reactor building and operational equipment in combination 
with the totally passive decay heat removal system, that requires neither motive nor control 
power. 

2.1.2.3 Protection against indirect effects of the earthquake 
2.1.2.3.1 Assessment of potential failures 

Internal flooding 

Internal water pipes that are connected to large water volumes are equipped with valves 
directly connected to these volumes. Worldwide industrial earthquake response experience 
(amongst others the Albstadt earthquake in Germany in 1978) showed in general little 
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damage to steel and reinforced concrete structures and mechanical equipment. Similar 
results were obtained in studies of earthquakes with PGAs up to 0.5g in the Pacific region 
(USA and Japan). The IAEA study "Earthquake experiences and seismic qualification by 
indirect methods in nuclear insta llations" IAEA-TECDOC-1333, that summarizes various 
studies of earthquake response concluded that piping systems survive earthquakes very well. 

Details about the internal flooding scenarios and its consequences are addressed in Chapter 
7 of this report (Other Extreme Events). 

Internal fire 

Protection against the risk of fire is ensured by a proper design of the safety systems and 
proper housekeeping. Inspection walk-downs with the local fire brigade are held on a regular 
basis as part of the "gebruiksvergunning" (operating license). The fire-fighting systems are 
supplied with water from the public water supply system. These systems are not seismically 
qualified. Details about the consequences of internal fires are addressed in chapter 7 of this 
report (Other extreme events). 

High energy equipment 

The only high energy equipment that might be present in the reactor are high pressure gas 
cylinders. Placement of these cylinders in the reactor building is very restricted. If present, 
they are secured to the wall of the reactor building. 

Loss of pool water 

The IAEA TECDOC-1333 that summarizes various studies of earthquake response concluded 
that piping systems survive earthquakes very well. AH piping penetrating the reactor pool 
bottom has jacket pipes with bellows between the pool bottom and the first isolation valve, 
creating a doublé walled containment. The primary piping is lying on the floor of the 
basement beneath the pool, which gives the primary piping a large insensibility to damage 
due to seismic loading. The layout of the primary system is tailored to absorb the differences 
in thermal expansion. Thermal stresses are the dominating loads in the pipes. For the HOR 
stress levels in the primary piping will only be slightly increased due to an additional seismic 
load. The connections between the various components of the primary cooling system are 
flexible enough to accommodate the seismic loads that can be expected for the HOR. In 
conclusion, based on expert assessment, a LOCA caused by earthquakes with magnitudes to 
be expected in the Delft region is very unlikely. 

Another possibility to loose pool water is damage to the pool itself. The resistance of the 
reactor pool is assessed in paragraph 2.2.1.1. 

Loss of pool water is dealt with in chapter 5 (5.1.2.5) 
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Loss of ultimate heat sink 



In case of an earthquake the reactor will be shut down and the pool functions as alternate 
UHS. The capacity of the pool is more than sufficiënt to remove decay heat (see chapter 5). 
Loss of pool water means loss of alternate heat sink, dealt with in chapter 5 (5.1.2.5). 
Details about the cooling modes are presented in that paragraph. Possible loss of the UHS is 
discussed in paragraph 2.2.1. 

2.1.2.3.2 Loss of external power supply 

A safe shut down of the reactor does not need external power. Shutting down the reactor 
and maintaining a safe shutdown state is a completely passive process. 

2.1.2.3.3 Situation outside the plant 

Based on the expected earthquake intensities, damage outside the plant can be expected. As 
the HOR can maintain its safe shut down state for a long time, see chapter 5, without 
outside assistance the impact of the situation outside the plant will be small. 

2.1.2.3.4 Other indirect effects (e.g. fire or explosion) 

Possible effects of earthquake induced (external) fires and explosions are addressed in 
chapter 7. The reactor building is founded on piles, which reach to a deep lying load bearing 
layers (sand, clay). The same is true for the stack. Liquefaction poses no direct danger to the 
reactor building. However, the ground at the surface around the reactor building is soft and 
susceptible to liquefaction. If liquefaction in the area around the reactor building occurs, 
connections to outside Utilities like electricity, gas, water, and sewer system will fail. 

2.1.3 Compliance of the plant which its current licensing basis 

2.1.3.1 Processes to ensure needed faultless condition 

Maintenance and operating procedures are in place to ascertain the proper functioning of 
structures, systems and components. No specific measures exist for earthquake situations, 
other than the maximum hold current through the electromagnets of the control rod 
couplings. 

2.1.3.2 Processes to ensure mobile equipment preparedness 

As there are no specific measures to deal with earthquake situations, there are no 
procedures that deal with mobile equipment and supplies that are planned for use, nor are 
those features available or external on stock. General procedures are in place to ascertain 
safe shut down and general safety. 
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2.1.3.3 Potential deviations from licensing basis 

No deviations with respect to the licensing base have been established. 

2.2 Evaluation of safety margins 

2.2.1 Range of earthquake leading to severe fuel damage 

The HOR contains only a limited amount of nuclear material. Fuel damage can occur in 
several ways: 

• The reactor pool gets damaged by an earthquake; 

• A leakage of pool water that cannot be isolated occurs as a result of an earthquake; 

• The stack falls onto the containment; 

• Core configuration is disturbed; 

• Configuration in spent fuel racks is disturbed. 

The first two cases could result in LAHS (see chapter 5 for details). The seismic resistance of 
the pool can be evaluated based on existing mechanical calculations. LOCAs that cannot be 
isolated are not to be expected (see paragraph 2.1.2.3.1). 

In the last cases structural damage may be inflicted to the fuel elements or the cooling flow 
may be disturbed. This may occur when the stack falls onto the containment and large 
pieces of debris of the stack break through and fall on the core or spent fuel causing damage 
and/or preventing cooling. 

For the stack no calculations are available that give an indication of its strength. Also no 
indications of the containments' strength for this kind of loads are known. It is therefore not 
possible to evaluate the seismic resistance of the stack and related missile impact to the 
containment. 

2.2.1.1 Reactor pool 

For the reactor pool and the structures within the pool the following failure modes are 
possible: 

1. Vibrations in the underground are transferred to the concrete foundation through the 
ground pressure; 

2. The pool walls could get damaged; 

3. The load on the pile foundation could become eccentric; 

4. Debris falls into the pool; 

5. The stack falls onto the containment, breaks through and debris falls on the core 
resulting in core damage. 
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2.2.1.1.1 Ground pressure 

The force that is required to accelerate the structure of the HOR, has to be transferred by 
the ground pressure to the foundation. With a simple static evaluation the force required to 
accelerate the pool is estimated. The calculation is based on the criteria formulated in NVR 
3.1, the Dutch nuclear Rules and Regulations a/o on seismic and SSG-9 the IAEA- "Seismic 
Hazard in Site Evaluation for Nuclear Installations". The total mass of the concrete and water 
is 2320 tons. The exerted force is: 

F = m * a * safety factor 10 = 2320 * 1 * 2 = 4640 kN 

The maximum counter pressure of the soil is estimated to be 2727 kN. This yields a margin 
of safety of 4640/2727= 1.7. The limiting earthquake (margin of safety equals 1) is an 
earthquake with an acceleration of 2727/2320 = 1.2 m/s 2 or 0.6 m/s 2 when taking the safety 
factor of 2 into account. Both values are far above the value of 0.22 m/s 2 that can be 
expected based on the earthquake risk map (see figure 2.3). 

In the evaluation above a number of simplifications have been made. The resistance of the 
tunnel beneath the reactor pool is neglected as well as the sideway support by the abutment 
piles of the foundation. 

2.2.1.1.2 Poolwalls 

The pool walls are 2.5 m thick at the location of the core and contain reinforcement. The 
pool walls will not be the part to fail first due to horizontal seismic accelerations. The pile 
foundation of the pool will fail first. However, as shown in the paragraph above this is very 
unlikely to happen. 

Seismic loads can induce sloshing in water pools. Large waves can overflow the pool rim and 
the pressure of the waves may damage structures standing in the water. However the 
seismic loads expected for the HOR can only cause a small rippling at the water surface of 
the pool. No damage due to pressure waves will occur to the structures in the pool. 

2.2.1.1.3 Eccentric loads on the pile foundation 

In order to estimate the resistance of the pile foundation against Earthquakes, the known 
resistance against wind loads is used, because the resulting load type acting on the 
foundation is the same in both cases. In case of an earthquake the horizontal ground 



Dynamic safety factor of 2 placed on the acceleration of 1 m/s 2 , to account for dynamic behavior in 
the static calculation 
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pressure does not act at the centre of gravity of the pool. As a consequence a moment is 
acting on the pile foundation. Wind loads acting on the reactor building also cause a moment 
acting on the pile foundation. Both loads are calculated in section 2.2.2. The eccentric pile 
loads due to a seismic load are much smaller than the eccentric pile loads due to the wind 
load acting on the reactor building. Because the margin of safety with regards to eccentric 
pile loads due to the wind load is large, it can be assumed that eccentric pile loads due to an 
earthquake will not yield problems. 

2.2.1.1.4 Falling debris 

The reactor hall of the HOR does not contain structures that can fall in the pool and onto the 
core. The only objects that can fall are objects that are temporarily brought into the reactor 
hall. Good housekeeping rules can prevent failure due falling debris. The edge of the pool 
should be kept free from objects. 

2.2.1.1.5 Stack 

The stack is standing close to the reactor building. No seismic evaluation has been 
performed for the stack. If the stack falls onto the reactor building failure of the containment 
cannot be ruled out. Through the failed containment debris from the stack might fall in the 
pool and onto the core. In this scenario core damage following containment damage cannot 
be excluded. It is recommended to perform a seismic evaluation for the HOR stack as well as 
to check the resistance of the containment against impact of debris. 

2.2.1.2 Stability of core configuration 

The core is hanging at the movable bridge across the pool. As a consequence of the seismic 
loads feasible for the HOR the bridge, including the core, cannot derail. The stability of the 
total structure is also enhanced because the core is hanging in the pool water, which acts as 
a damper for seismic vibrations. Loss of core configuration impairing cooling of fuel elements 
in the core is therefore not to be expected. 

2.2.1.3 Stability of storage racks 

Two types of storage racks are applied in the HOR pool. The first type is fixed to the walls 
and will only fail if the pool walls fail. The second type is standing on the floor of the pool. 
The worst case incident for this type of storage rack is toppling. However, this type of 
storage rack has a larger diameter than height, which gives it an inherent stability against 
toppling. 

2.2.1.4 Safety of dome crane during an earthquake 

It is unlikely that the containment crane will drop from its support. The support of the crane 
is an integral part of the dome structure. The crane falling of its support is only possible if 
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the dome structure deforms excessive or completely fails. This will not happen at the 
earthquakes that can be expected in the Delft region. 

Breaking of the crane girders during an earthquake is also unlikely. This requires an 
overloading of the girders. Cranes are designed with large safety margins incorporated. The 
earthquakes that can happen cannot cause an overload in the crane girders. 

The crane trolley does not derail. The large flanges on both sides of the wheels prevent this. 
Moving apart of the crane girders is also unlikely. 

The staircase to the central turn pivot is supported at the two ends: the turn pivot in the 
centre of the dome and to the end points of the crane girders by means of welded plate 
supports. The design looks robust, but it should be checked whether it can bear the total 
mass of the staircase and the stability of these connections during an earthquake should be 
investigated in more detail. 

2.2.2 Range of earthquake leading to loss of containment integrity 

The seismic resistance of the containment can be evaluated based on existing calculations. 
The maximum peak ground acceleration that can occur at the HOR site is 0.22 m/s 2 
according to data from KNMI. The area in the vicinity of the HOR is considered an area with 
a low seismic risk. According to the Dutch NVR 3.1 and the IAEA guideline SSG-9 (see 
2.2.1.1.1) nuclear facilities in an area with low seismic risk have to be designed to withstand 
an earthquake with a peak ground acceleration of at least 1.0 m/s 2 . 

The evaluation of the strength of the containment against earthquakes is based on the 
design of the containment against wind loads. The containment is designed for a wind load 
of 1250 N/m 2 . The drag weight of the containment is specified: 120 kg/m 2 . Based on a 
simple static evaluation, utilizing a safety factor of 2 on the maximum seismic acceleration of 
1 m/s 2 the maximum seismic force acting on the containment is 240 N/m 2 . Compared to the 
wind load this gives a safety margin of 5.2. 

The earth-quake resistance of the containment isolation valves is unknown. However as long 
as the fuel is not damaged, loss of containment is not a problem. 

2.2.3 Earthquake and consequent flooding exceeding design basis 

In chapter 3 (external flooding) it is shown that an earthquake induced flooding is not to be 
expected on the Dutch coast. 



74/162 



CSA-HOR 25-04-2013 v1.1 



2.2.4 Measures to increase robustness of the plant against earthquakes 
Potential cliff-edge effects 

Potential cliff-edge effects induced by an earthquake are related to damages to the HOR that 
result in loss of cooling of the fuel elements: 

• Leakage of the pool through the walls or through connected piping (especially 
below top of fuel); 

• Damage of core or spent fuel by debris from the stack, causing loss of 
configuration and thus loss of coolant flow; 

• Control rods that are stuck. 

Measures for improvement 

Whether or not these potential cliff-edges are real cliff edges cannot be determined as a 
result of lack of information. Therefore it is recommended to elaborate these issues for their 
feasibility and decide later on additional measures e.g.: 

• The cooling capabilities in case of loss of pool water should be investigated (see 
chapter 5 for more details); 

• A seismic evaluation of the HOR stack and the impact resistance of the 
containment is recommended; 

• The magnetic holding force of the control rods should be tested to ascertain the 
assumption that drop of these rods into the core will occur in case of the type of 
earthquakes to be expected in the Delft region; 

• Although means to supply water to the storage tank are available, an instruction 
is missing and should be drafted. 

• Evaluate the resistance against earthquake loading of the two support points of 
the staircase to the central turn pivot of the crane. 
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3 Flooding 



This chapter describes the outline of the analysis of the HOR with respect to flooding 
conditions from external sources. As the HOR is located in a polder, that is part of dike ring 
14 (see Figure 3-3), the flooding conditions considered are flooding of the polder as a result 
of dike failure, caused by high tides, storm surges or high water levels in the rivers and high 
water table (ground water level). 

3.1 Flood sources 

3.1.1 Flooding from the North Sea 

3.1.1.1 High tide and storm surges 

A high tide, possibly in combination with a storm surge may lead to flooding of dike ring 14. 
Although given the design level of the coastal defense against flooding and the location of 
the HOR (15 km from the sea) the probability of flooding caused by high tides/storm surges 
is very low. However it cannot be completely excluded, given the fact that the ground level 
of the HOR is below mean sea level. 

3.1.1.2 Tsunami 

From history, there is evidence of only a few tsunamis in the West European region. These 
tsunamis are discussed shortly and the possible impact of a tsunami on the Dutch coast is 
discussed 

1 . Storegga Slide (approximately 8200 years ago) 

Large parts of the now submerged North Sea Continental shelf (now part of the North Sea 
between the Netherlands and UK)) were flooded by the Storegga Slide tsunami, one of the 
largest tsunamis known for the Holocene, which was generated on the Norwegian coastal 
margin by a submarine landslide. The characteristics of the wave triggered by this ancient 
event were simulated. A calculated initial wave height of 3 m at the source of the model 
results in maximum deviations of about 0.5 to 0.7 m at the tidal gauges in the German Bight. 
It would take approximately 8.5 hours for the first wave to reach the German coast line. 

Geological models suggests that for a tsunami such as the one following the Storegga slide, 
another glaciation (time scale ~ 100,000 years) is needed to re-establish the conditions 
required for a similar failure at that location. However, there are other sections of the 
neighboring Continental shelf that have the potential for a landslide, possibly triggered by an 
earthquake. 
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2. Lisbon Earthquake (1755) 



The tsunami triggered by the 1755 Lisbon Earthquake reached Holland, although the waves 
had lost their destructive power. Waves at the origin had an amplitude of 1 m. After 5 to 8 
hours waves with a height of 0.8 to 2 m reached the Cornwall coasts with localized 
amplification enhancing the elevations to approximately 4 m. A tsunami entering the North 
Sea from the English Channel will not have any severe consequences in the North Sea, since 
this wave will be reflected and diminished in the English Channel. 

3 . Dogger Bank earthquake (1931 ) 

This earthquake, which measured 6.1 on the Richter scale, caused a small tsunami (wave 
amplitude at the origin 1 m). After 1 to 2 hours waves with a height of 0.8 to 2 m reached 
the Yorkshire and Humberside coasts. 

Possible impact at Dutch coast 

In a study performed in 1993, it was concluded that a hypothetical tsunami would result in a 
maximum elevation of the water level of 1.4 m along the Dutch coast. This is below the 
observed normal high tides. Based on this result the risk of flooding due to a tsunami is 
regarded as non-existent. This conclusion is supported by more recent research. For the 
German Bight it was concluded in 2007 that Cuxhaven will be protected by the shallow North 
Sea from the catastrophic impacts of a hypothetical tsunami. Waves of 0.5 m are expected. 
The same study showed waves of approximately 2 m at IJmuiden. As far as the Belgian 
coast is concerned, research concluded in 2005 that a hypothetical tsunami will not grow to 
an amplitude of several meters but to a maximum of 0.7 m, due to damping in the relatively 
shallow North Sea. 

In conclusion: a tsunami will have no impact on the HOR. 

3.1.2 Flooding of the ri vers 

From landside the polder could be flooded either by high water in the river Rhine or the 
"Nieuwe Waterweg" which is located approx. 12 km to the South of Delft. In the latter case 
the high water level can also be caused by high tides/storm surges on the North Sea that 
disturb the normal discharge of the river. However flooding of either of these rivers or a 
combination are part of the design criteria of dijkring 14. In the "Nieuwe Waterweg" for 
instance a storm surge barrier will be closed on specific high tide conditions. 

3.1.3 Flooding by water-table 

As the ground level of the HOR site is under sea level (-1.2 NAP, see paragraph 3.2), the 
water table level is kept artificial below this level. A protracted loss of the pumping activity 
will ultimately end in flooding of the site. However, this is a slow process with ample time to 
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restore pump capacity, before the water levels reaches values that threaten the safety of the 
HOR. Therefore this scenario will not be further considered. 

3.2 Design base 

In the design and licensing process of the HOR the possibility of flooding has been taken into 
account, as the polder and thus the institute's ground level ("maaiveld") is below mean sea 
level (NAP): At the location of the HOR the ground level is approximately -1.2 m NAP. The 
design against flooding is elaborated in the Safety Report. Figure 3-1 shows the height 
contours around Delft. The location of the reactor institute is marked with the label 
"AHN1: -1.2 m". Figure 3-2 shows the same for the close vicinity of the institute. 




Figure 3-1: Ground level around Delft (source): het Actueel Hoogtebestand Nederland (AHN) 
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Legenda: meters boven NAP 




M Aangepast kleurenschema 




Figure 3-2: Ground level around the HOR site (source: Het Actueel Hoogtebestand Nederland (AHN) detail 
3.2.1 Flooding against which the plant is designed 

The Safety Report states that the water in the polder where the HOR is situated can reach a 
level of 1.2 m NAP (+2.4 m above ground level) under the most severe circumstances. The 
reactor building, including its doors, is designed to withstand the single sided water pressure 
that arises from this flooding height. 

The other buildings, including those housing the cooling and electrical systems are not 
specifically designed against flooding. The control room in the control room building however 
is situated at 10.5 m above ground level and is thus protected against flooding. The no- 
break batteries for instrumentation (1 hour capacity) are located in the control room. The 
alarm staff room is situated on the ground floor of the main building (0,3m NAP). 

During a possible flooding of the HOR site access to the reactor hall is secured, as the 
second personnel lock is also located at the same level as the control room (10. 5m above 
ground level). 
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3.2.1.1 Characteristics of the design base flood (DBF) 

The design based flood is only characterised by the maximum credible water depth of 2.4 m 
above ground level (+1.2m NAP) as described in the Safety Report. 

However, it is to be expected that given the inland location of the reactor far from the 
outside dikes of dike ring 14, the water level in case of a flooding is a static load; the water 
rises rather slowly and no significant wave action has to be expected. 

3.2.1.2 Methodology used te evaluate the design base flood 

Although the Safety Report and design documentation give little information on the 
background of the design level an evaluation is still possible. Recent literature, like the 
"Overstromingsschade I Dijkring 14", J.P. van Schrojenstein Lantman and the 
"Coordinatieplan dijkring 14, RWS, on flood protection, flood risk assessment, and 
evacuation planning gives flooding scenarios for dike ring 14. Figure 3-3 gives an overview of 
this dike ring. There are two sources of water that potentially threaten dike ring 14: the 
North Sea and the river Rhine. For both flood sources worst case scenarios are developed 
and resulting water levels inside dike ring 14 are calculated. 




Figure 3-3: dijkring 14, rode lijn; source: Coordinatieplan dijkring 14, RWS 
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North Sea scenario 

In case of a storm surge on the North Sea the worst case scenarios are those with multiple 
failure of the dike ring. In figure 3-4 the result of a fourfold breakthrough of the North Sea 
can be seen. At the location of the HOR the resulting flood height is below 2 m, which is 
below the design level of the HOR of 2.4 m. 

River Scenario 

During flooding of a river multiple breakthroughs are not to be expected, even in a worst 
case scenario. The reason for this is that contrary to flooding from the sea, the water level in 
the river will drop in case of the first break through, which will lessen the pressure on the 
river dike and preventing further failure. Figure 3-5 shows the results of flooding analyses. 
As the water will not reach the Delft area, it will be clear that the river scenario is no threat 
to the HOR. 

Water table scenario 

In case the artificial level of the water-table cannot be maintained water will rise to 
approximately Om NAP. This means that flood height will become 1.2m, which is below the 
design level. 

3.2.1.3 Conclusion on the adequacy of protection against external flooding 

The North Sea scenarios are the flooding scenarios determining the maximum credible 
flooding height. These scenarios do not challenge the design level of the plant. 

3.2.2 Provisions to protect the plant against the design base flood 
3.2.2.1 SSC's required for achieving safe shutdown state 

To reach and maintain a safe shut down state three main safety functions have to be met. 
This section gives a brief overview of the safety functions and the SSCs (The SSCs are 
extensively described in chapter 1): 

1. Control of reactivity. In the reactor building the reactor core and spent fuel are 
present plus the (previously used) experiments. Main systems for controlling the 
reactivity of the core are the control rods, the control drive mechanisms and the 
reactor protection and control system. Spent fuel is kept in a safe subcritical 
configuration by design and procedures; 
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2. Cooling: Main cooling systems are the forced or natural convection 11 flow open loop 
primary cooling system, the open secondary cooling loop and the air cooling towers. 
Decay heat removal is performed by convection cooling with pool water; 

3. Confinement Confinement is provided by successively the fuel matrix, the fuel 
cladding, and the containment building. The primary system boundary plus the pool 
provide a semi confinement function located between the fuel matrix and the 
containment. 




Figure 3-4: Worst case case scenario North Sea; source: Coordinatieplan dijkring 14, RWS 



11 Operation mode with natural convection is limited to 750 kW core power 
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Figure 3-5: Worst case scenario River: source: Coordinatieplan dijkring 14, RWS 



3.2.2.2 Main design and construction provisions to prevent flood impact 

The main design and construction provision to prevent flood impact is the combination of a 
watertight containment up to a flooding depth of 2.4 m above ground level (+1.2 m NAP) 
and the passive cooling behaviour of the HOR. 

In case of power failure - which is very likely to occur in case of a major flooding - the 
reactor will scram automatically, as the electromagnets of the control rod drives will fail to 
hold the rods in that situation. As a result the rods will fall into the core and the core 
becomes sub-critical within 1 second. 

The decay heat removal system is a totally passive system that requires neither motive nor 
control power. The moment the primary pump is stopped the suction head of the primary 
suction line drops to its resting position by gravity. A gap between the suction head and the 
core support plate is created and convection cooling starts. Convection cooling is the 
Standard way of decay heat removal after shut down of the reactor and is sufficiënt to 
prevent core damage (see paragraph 1.3.2). 
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In conclusion, in case of a normal shut down, loss of power or loss of forced primary flow 
the reactor is automatically brought into a safe shut down state. 

3.2.2.3 Main operating provisions to prevent flood impact 

There are no particular operating provisions in case of an anticipated flooding, however in 
case a possible flooding is expected the HOR will be manually shut down. 

3.2.2.4 Situation outside the plant 

In case of a flooding of the polder the HOR is located in, a large part of the province of Zuid- 
Holland between Rotterdam, Den Haag and Leiden will be flooded as well, see Figure 3-4. 
The site will be difficult to reach. Even as the HOR site itself, due to its relatively high 
elevation, is not surrounded by water, Loss of Offsite Power may occur. In this case the HOR 
site relies on the diesel generator for power. As the diesel generator is not protected against 
flooding, one cannot rely on it. This does not pose a problem as the design of the HOR is 
such that safe shut down can be reached and maintained without electrical power. 

3.2.3 Plant compliance with it's current licensing basis 

3.2.3.1 Processes te ensure needed faultless condition 

Maintenance and operating procedures are in place to ascertain the proper functioning of 
structures, systems and components. No specific measures -other than the water tightness 
of the containment- exist for (threatening) external flooding situations. Once a year the gas 
leak tightness of the containment is tested, which is described in a procedure. Once every 
two years the containment is assessed visually. 

3.2.3.2 Processes to ensure mobile equipment prepardnes 

As there are no procedures to deal with flooding situations, there are also no procedures for 
using mobile equipment and supplies in case of a flooding. 

3.2.3.3 Potential deviations from licensing basis 

No deviations with respect to the licensing base have been established. 

3.3 Evaluation of safety margins 

3.3.1 Estimation of safety margin against flooding 

The safety margins against flooding will be assessed by a step increase of the flooding level. 
The relevant flooding levels are given in Figure 3-6. These levels are based on the levels 
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safety (related) equipment becomes unavailable by flooding, and are as such not per 
definition equal to floor level. 



Top of pool 



Air inlet inside containment 



Design limit flooding 
10kV transformer 



Dieselgenerator 
lOkV sub-station 



Primary pump 



Om NAP / Mean Sea Level 



Ground Level = -1.2m NAP 



Figure 3-6: Heights of Safety relevant systems and structures. 

The primary pump is the first system to fail. It is placed at 3.8m below ground level (-5m 
NAP). The pump is located in the basement below the reactor hall. This basement is not 
protected against water from outside the buildings and the pump itself is also not protected 
against flooding. This means that in case of flooding of the polder, the basement will almost 
immediately be flooded as well, even at very low flooding levels. This will result in a failure 
of the primary pump followed by a stop of the forced cooling flow. The following two things 
will happen: 

1. The reactor scrams due to loss of primary cooling flow signals; 

2. The suction head of the primary suction line underneath the core sinks and detaches 
itself from the core support plate. Convection cooling will start and secure cooling of 
the core. 

The primary piping and heat exchanger will not be damaged as additional forces from the 
water on those components will be minimal. The amount of water in the pool is sufficiënt to 
cool the core for at least three years, Appendix D. 
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At 0.2m above ground level the lOkV substation feeding the 10kV/0.4kV transformers of the 
HOR becomes submerged, resulting in Loss of Off-site Power. The diesel generator will take 
over the supply of a limited number of systems like instrumentation. The cooling situation of 
the core does not change. 

The next system to flood is the diesel generator, which floods at a level of approximately- 
0.6m NAP (0.6m above ground level). A station black out, as described in chapter 5, is the 
result: the Power to all systems is lost and instrumentation will follow in 1 hour after 
depletion of the batteries. No information on the condition of the core and the conditions 
inside containment is available. Convection cooling of the core is not impacted, so the core 
stays in safe shut down state. The amount of water in the pool is sufficiënt to provide 
cooling capacity for at least 3 years, Appendix D. 

At a level of +0.8m NAP (2 m above ground level) a Station Black-Out (SBO) will definitely 
occur as the lOkV transformer, which could still be fed by the public grid, will start to be 
submerged, while the diesel generator is already submerged at a water level of -0.6m NAP. 

At 2.4m above ground level (+1.2m NAP) the design limit of the containment building 
against external flooding is reached. A breach of containment may occur. If this happens 
water will enter the reactor hall that has no additional consequences as cooling is completely 
passive and the stability of the pool is not immediately threatened. The stability of the 
reactor hall could be temporarily threatened until the water inside and outside the building 
levels out. 

If the reactor hall does not fail at its design limit the reactor hall will start flooding through 
the air inlet of the water seal at a height of 3.8m above ground level (+2.6m NAP). The 
consequences are the same as when a breach of containment occurs. The water will enter 
the reactor hall, but the containment function stays intact. The protection against 
overpressure in the reactor hall by the water seal fails because flooding of the inlet will result 
in higher "seal break pressure". 

At 8m above ground level (+6.8 m NAP) the water reaches the top of the pool. This does not 
influence the cooling of the core. The cooling water however is now in contact with the 
outside of containment, and radioactive pollution of the environment is possible. As water is 
both on the outside and the inside of the reactor hall its containment stability is not 
immediately threatened. Still higher water levels do not change this situation, so fuel 
damage is no issue. In other words there is no cliff edge for flooding. 

3.3.2 Measures to increase robustness of the plant against flooding 

Of the three main safety functions only confinement is possibly jeopardized by flooding. 
Criticality and cooling are not threatened as shut down is assured by the reactor protection 
system and decay heat is absorbed by the pool. 
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Recent studies indicate that water heights that can be expected from floods will not exceed 
2m above ground level. These levels are below the HOR design level (+2.4 m above ground 
level). Furthermore, in case of a possibly expected flooding it can be decided to shut down 
the reactor as a precaution (Good housekeeping) to ascertain that the reactor will be in safe 
shut down state before the primary pump is lost and, if needed, that the core is unloaded, as 
there will be time between the start of the flooding and the water reaching the HOR. 

Robustness of the confinement function might be increased by modification of the water seal 
in such a way that flooding of the inlet will not result in higher "seal break pressure". 
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4 Extreme weather conditions 



4.1 Design basis 

This chapter describes the design basis of the HOR with respect to extreme weather 
conditions. The following weather conditions are taken into account: 

• extreme high and low air temperatures; 

• extremely high wind (including storm and tornado); 

• wind missiles and hail; 

• heavy rainfall; 

• heavy snowfall; 

• formation of ice; 

• lightning; 

• credible combinations of the conditions mentioned above. 

It is noticed that all data with regard to weather conditions, that is presented in this chapter 
originate from the KNMI, the Royal Netherlands Meteorological Institute. 

4.1.1 Reassessment of weather conditions used as design base 
4.1.1.1 Verification of weather conditions used as designed base 
Extreme high and low air temperatures 

No minimum or maximum outside air temperature is defined as design base. 

Reactor operation is affected by the outside temperature due to the effect on the 
temperature in the reactor building and the cooling capacity of the secondary cooling system 
(cooling towers). The temperature in the reactor building is controlled by control of the air 
inlet. A "frost pump" (CV pump) starts automatically (when switched in the frost position, 
which is default) when air temperature reaches 4°C. When the frost pump fails the air 
treatment is stopped automatically, followed by an AIS. 

If temperature of the pool water becomes higher than 40°C, power of the reactor is reduced 
(AIS). If temperature of the water in the secondary cooling system is likely to become lower 
than 4 °C during shut down periods (e.g. weekends) , the secondary water is heated. 

The diesel generator, including pipelines and storage tanks, are placed in a (heated) 
building. Low and high outside temperatures have no impact on the diesel generator 
operability. 
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Extremely high wind (including storm and tornado) 

The original design basis of the reactor building was a wind speed of 45 m/s. In 1995, 
stability calculations of the containment of the HOR were performed by the engineering 
company Comprimo. Several loads were induced at the same time such as pressure of snow 
at the top (500 Pa), under pressure in the reactor building (1500 Pa), wind pressure in X- 
direction (2500 Pa) and external water pressure of 2.4 m. It was concluded that the 
containment has 17 % margin with respect to buckling. For wind speed therefore a design 
value of 63 m/s (which is based on a pressure of 2500 Pa) is assumed. 

The ventilation stack is 60 m high and is located 30 m to the east of the reactor building (see 
Figure 1-2) and made of reinforced concrete. The wind load at which the ventilation stack 
falls down and consequently may hit the reactor building is unknown. 

Wind missiles and hail 

Wind missiles are projectiles propelled by extreme wind. A credible effect caused by 
projectiles could be Loss of Offsite Power due to damage to the power lines or the 
switchyard. This type of event is included in the Loss of Offsite Power sequences (see 
Chapter 5). 

Hail is defined as precipitation in the form of spherical or irregular pellets of ice larger than 5 
mm in diameter. Extreme hail can cause blockages in the cooling towers of the secondary 
cooling system. If the cooling capacity of this facility is not sufficiënt, safety systems will 
automatically reduce the reactor power. 

It is possible that wind missiles could damage the reactor building but it is deemed unlikely 
that severe damage will occur which influences reactor operations. 

Heavy rainfall 

Extreme rainfall may induce additional force on building roofs. In case of raised edges, water 
can accumulate on top of the buildings if all drainage pipes are blocked. 

Because the reactor building is dome-shaped, accumulation of rainwater is excluded. The 
roof of the pump building (secondary heat removal) has 

only small raised edges, ~ 5 cm, on a small part of the roof. The largest part of the roof is 
occupied by the steep shaped cooling towers where accumulation cannot occur. The water 
on the flat part is removed by two downspouts. When the downspouts are blocked, water 
flows over the edges. The design of the roof is according to NEN 1055 (load capacity of 70 
kg/m 2 corresponding to ~7 cm water), so water load will not lead to damage of the roof in 
case of accumulation. 
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The roof of the control room is provided with two internal downspouts. The edges of the roof 
are relative high ~ 30 cm. No overflow holes are made in the edges. The construction is 
designed according to NEN 3850 (load capacity of 75 kg/m 2 corresponding to ~8 cm water). 
In case of blockage of the downspouts water may accumulate on the roof till 30 cm. This 
may seriously damage the roof of the control room. Ultimate consequences are collapse of 
the roof of the control room causing damage to instrumentation and cabling. In the ultimate 
case, the control room will lose all connections to instrumentation resulting in the loss of 
control and monitoring functions. Due to loss of connections (power loss), safety systems 
like RSA, BIS and RIS are "activated" and fall into their fail safe positions. This means that 
the reactor is made subcritical and the pool and reactor building are isolated. So the three 
basic safety functions reactivity control, confinement and cooling are ensured. 

Other buildings like the experiment hall and offices, are build according to NEN 6702 (new 
buildings) and NEN 1055 (old buildings) and provided with low edges (~5 cm) or higher 
edges with overflow holes, and downspouts. Eventual accumulation of rainwater does not 
lead to excessive forces on the roofs. 

The RID area is not situated in a lower part compared to its surrounding area so no extra 
water from the surroundings will flow to the site area. For rainwater flowing to lower parts of 
the building via inclined roads/paths (for instance directly at the right side when coming 
through the main entrance), drain channels are provided. From these drains the water is 
pumped to channels outside the RID area. Failure of drain pumps may cause flooding in the 
basement of the reactor building in case of extreme rainfall. Flooding is covered in chapter 3. 

Heavy snowfall 

Heavy snowfall may lead to accumulation of snow on roofs, inducing a load on the civil 
structure. The RID buildings are designed according to different standards, due the 
differences in age and type. HOR, 

The reactor building is designed for extreme situations. The design takes into account 
(calculations of Stork Comprimo 1995) a simultaneous occurrence of extreme winds, 
flooding, abnormal underpressure in the hall and a snow layer of 50 cm. The design value of 
50 cm is therefore very conservative. Moreover, Iif it continues to snow for an extended 
period, no larger values of snow build up are to be expected for the reactor building due to 
its rounded shape. 

The older buildings (and auxiliary buildings (e.g. pump building, and offices), isare designed 
according to the NEN Standard 1055 to withstand the credible consequences of snowfall. 
Building Standard NEN 1055 specifies a maximum snow load on flat roof tops of 70 kg/m2 
which corresponds to a level of fresh snow of approximately 70 cm. 
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The new offices and experiment hall are designed according to NEN 6702, which specifies a 
maximum snow load of 58 kg/m2, which corresponds to a level of fresh snow of 
approximately 60 cm. 

Formation of ice 

The formation of ice on the Schie, a water channel at 800 m distance from the reactor 
building, does not influence the safe operation of the HOR (HOR is independent of the 
Schie). 

Freezing of water in pipelines or water tanks in the pump building is prevented by heating 
elements inside the pump building and in the water collector on top of the building. 

Freezing of other pipelines is prevented because water pipelines are underground. In the 
diesel building all pipelines are inside in the heated room. The pipe-basement is heated. 

The inlet of the reactor building ventilation consists of a coarse grid in the building wall at 
ground level (auxiliary building) and leads to filter bags in the basement. Blockage of the 
filter bags by freezing (very improbable) gives a pressure difference signal in the control 
room. The ventilation system comprises a supply fan and an extractor fan keeping the 
containment pressure at about 100 Pa below atmospheric pressure (under pressure). When 
the inlet (coarse grid or filter bags) is significantly blocked, the supply air flow will decrease. 
As a result the pressure in the reactor building will decrease since the extraction fan is still 
running. At 200 Pa containment under pressure a low pressure control valve is opened to 
provide additional bypass inlet air. The ventilation system will stop automatically at a 
containment under pressure of 290 Pa. An AIS will follow. The fundamental safety functions 
are not threatened. 

Lightning 

Besides the standards for lightning protection to the reactor dome and adjacent buildings, 
storm is not explicitly included in the design basis. Lightning could affect the installation by 
lightning strikes, and may disrupt electronics due to strong accompanying electromagnetic 
pulses. If electromagnetic pulses strongly influence electronic equipment, safety systems are 
designed in such a way that the reactor is shut down. In case of failure of external power 
supply due to lighting, the reactor is scrammed. The scram is passive (control rods are 
gravity driven) so there is no need for internal or external power supply. Since the heat 
capacity of the pool is sufficiënt to absorb the residual heat from the core for a very long 
period (see chapter 5), no external cooling is required. 
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4.1.1.2 Postulation of proper specifications for extreme weather conditions 

The data on extreme weather conditions are used of the KNMI weather stations Rotterdam 
Airport and Delft. The KNMI data have been used for the period between 1956 and the 
present. 

Extreme high and low air temperatures 

The maximum air temperature measured is 35.0 °C on 9 July 2010. The lowest air 
temperature measured is -17.4 °C on 7 January 1985. According to the Intergovernmental 
Panel on Climate Change (IPCC) an average temperature increase of 1.1 to 6.4 °C for the 
next century can be expected. 

Extremely high wind (including storm and tornado) 

For wind types, the following subdivision is used: 

• Extreme wind speed (hourly average) 

• Wind gusts (usually less than 20 seconds) 

• Whirlwinds (unpredictable). 

Extreme wind speed 

The highest wind speed measured is 23.7 m/s on 25 January 1990. Research shows that the 
maximum wind speed (hourly average) that can be expected once every 10,000 years is 
approximately 35 m/s. 

Wind gust 

A wind gust is a sudden, brief increase in speed of the wind. The duration of a gust is usually 
less than 20 seconds. KNMI has determined that the maximum wind gust is roughly 1.5 
times the maximum hourly average wind speed. At a wind speed of 35 m/s, this results in a 
maximum wind gust of 53 m/s once every 10,000 years on average. The highest wind gust 
measured is 41.7 m/s on 25 January 1990. 

Whirlwind 

The highest wind speed that was observed by a monitoring station due to a whirlwind in the 
Netherlands is 56 m/s. On average, each year about two whirlwinds cause some damage to 
the infrastructure somewhere in the Netherlands, over an area of one square kilometre. It is 
estimated that for a random location in the Netherlands, the risk of damage by a whirlwind is 
10" 5 per year. 

Heavy rainfall 

According to the statistics of the KNMI, in the Netherlands once in 10 years a rainfall of 50 to 
62 mm will occur in some place. During the summer period it is possible that locally more 
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than 100 mm rain can fall. The largest recorded amount of rainfall in one day in Delft is 77 
mm on 14 September 1998. 

Heavy snowfall 

On average, occasions of more than 20 cm of snowfall occur once every 10 years and more 
than 35 cm occurs once every 50 years. 

Lightning 

Lightning occurs on average 2 to 3 times per km 2 /year. Lightning strikes occur in the region 
of Delft approximately 28-30 days a year. 

4.1.1.3 Assessment of the expected frequency of the design base conditions 

In section 4.1.1.2 the expected frequencies of the design base conditions are given for the 
weather phenomena. It must be noticed that the design base conditions used in the fifties 
sometimes (they are unknown) differ from the extreme conditions used in 4.1.1.2. No major 
changes are to be expected in the return frequencies of the discussed phenomena. Most of 
the phenomena may be subject to climate change over a longer period. 

4.1.1.4 Consideration of potential combination of weather conditions 

High wind velocities combined with heavy snowfall may cause line galloping and lead to Loss 
of Offsite Power. However, this does not threaten the safety systems of the HOR. 

The combination of high winds, extreme rainfall and lightning can be expected during a 
thunderstorm. Because the loads caused by these weather conditions are independent, the 
effect on the plant will not be reinforced. 

4.1.1.5 Conclusion on the adequacy of protection against extreme weather 
conditions 

The design basis wind velocity of 63 m/s gives some safety margin to the maximum highest 
wind velocity that was monitored in the Netherlands (56 m/s due to a whirlwind) or the 
maximum wind gust of 53 m/s which can be expected once every 10,000 years. The 
consequences of a wind speed of 56 m/s on the ventilation stack on the reactor building, are 
however unknown. The reactor building might be damaged by (concrete parts of) the 
ventilation stack in case of extreme wind. It is therefore recommended to investigate the 
allowable load on the ventilation stack. 

For extreme rainfall the roof of the control room is not sufficiently protected. It is 
recommended to provide the roof of the control room with blocking proof rainwater drains, 
like overflow holes, to prevent accumulation of rainwater and exceedance of the roof design 
load. 
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4.2 The design is sufficiënt to protect the HOR against the other 
discussed phenomena.Evaluation of safety margins 

4.2.1 Estimation of safety margin against extreme weather conditions 

This paragraph contains an analysis of the potential impact of different extreme weather 
conditions on the safe operation of the HOR. The safety margin is defined as the difference 
between the allowable load (by design and/or by building Standard) and the maximum load 
on buildings that can be expected as a result of the extreme weather conditions. Loads due 
to snowfall, rainfall and wind are derived from the weather conditions listed in the previous 
section. The remaining conditions (air temperature, formation of ice and lightning strike) 
cannot be translated into explicit loads and are only qualitatively discussed (i.e. not 
quantified). 

Extreme high outside air temperature 

Extreme high outside air temperatures will not threaten the fundamental safety functions of 
the HOR. When heat removal from the secondary system to the air in the environment is 
limited, reactor power is reduced. 

In the ultimate case when no heat can be transported to the environment, the temperature 
of the water in the pool will slowly increase. Extreme high outside air temperatures will have 
only a slow direct impact on the temperature of the pool water. The heat capacity of the 
pool is sufficiënt to absorb the residual heat of the core for a very long period (see chapter 
5). 

Extreme low outside air temperature 

The temperature in the reactor building is controlled by control of the air inlet. A"frost 
pump" starts (when switched in the frost position) when air temperature reaches 4°C. 

If temperature of the water in the secondary cooling system is likely to become lower than 4 
°C during shut down periods (e.g. weekends), the secondary water is heated. 

The heat capacity of the pool is sufficiënt to absorb the residual heat of the core for a very 
long period (see chapter 5). 

Extremely high wind (including storm and tornado) 

The design basis wind velocity of the reactor building of 63 m/s gives some safety margin to 
the maximum highest wind velocity that was monitored in the Netherlands (56 m/s due to a 
whirlwind) or the maximum wind gust of 53 m/s which can be expected once every 10,000 
years. The impact of a wind speed of 56 m/s on the ventilation stack is unknown. 
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Wind missiles and hail 

The fundamental safety functions are not threatened by a loss of external power due to 
damages of missiles and hail. No cliff-edge is expected concerning damage of the buildings 
due to either wind missiles or hail. 

Heavy rainfall 

Because the reactor building is dome-shaped, accumulation of rainwater is excluded. 

A small part of the roof of the pump building (secondary heat removal) has raised edges of 
~5 cm, so water cannot accumulate above the design load. For the other buildings, small 
raised edges or overflow holes prevent water for accumulating above design load. For this, 
the safety margin is very high. 

For the roof of the control room, raised edges are too high to prevent the roof for 
overloading in case the downspouts are blocked. 

Heavy snowfall 

The shape of the building does not allow for a large build-up of snow. Due to the design of 
the reactor building according to NEN 1055 and the shape of the building, a high safety 
margin can be applied. 

For the small flat area of the pump building the margin for extreme snowfall is 35 cm. For 
the roof of the control room this margin is 40 cm and for the other buildings 25 cm. 
Formation of ice 

Formation of ice on the Schie is not relevant for the HOR. 
Lightning 

If the facility is subjected to lightning pulses with amplitudes above the designed levels, 
damage or false actuation of I&C channels may be initiated. This may lead to the shutdown 
of systems or a situation of Loss of Offsite Power (see chapter 5), which will lead to a reactor 
shut down. Cooling of the reactor is always ensured by the pool water. 

4.2.2 Measures to increase robustness of the plant against extreme weather 
conditions. 

It is recommended to investigate the allowable wind load on the ventilation stack. Depending 
on the outcome of this investigation the possible impact of the ventilation stack on the 
reactor building should be investigated. 
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It is recommended to provide the roof of the control room with blocking proof rainwater 
drains, like overflow holes, to prevent accumulation of rainwater and exceedance of the roof 
design load. 
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5 Loss of electrical power and loss of ultimate heat sink 



5.1 Nuclear reactors 

5.1.1 Loss of e lectr ica I po we r 

In line with generic definitions, for the HOR the following plant states can be defined with 
regard to loss of electrical power: 

1. Loss of off-site power (LOOP); 

2. Loss of off-site power and station black out (LOOP-SBO). 
The assumptions for the separate plant states are: 

1. Loss of off-site power (LOOP) 

This state is characterized by the unavailability of: 

• supply by the on-site lOkV power station that is fed by the external grid. 

2. Loss of off-site power and station black out (LOOP-SBO) 
This state is characterized by the unavailability of: 

• supply by the on-site lOkV power station that is fed by the external grid, plus; 

• the diesel generator (also located on-site). 

For both plant states it is initially assumed that uninterrupted power supply by batteries is 
available. 

The Electrical Power System (EPS) contains three sections (see Appendix A). 

From the safety point of view an emergency power supply is not necessary. When there is a 
power failure a RSA (Reactor Scram), a RIS (Reactor Hall Isolation) and a BIS (Pool 
Isolation) take place. However back-up power, supplied by a diesel generator, ensures that 
information, for monitor in g, is available and the reactor hall is accessible. 

5.1.1.1 Loss off-site power 
5.1.1.1.1 Design provisions 
Design provisions 

The main power supply is obtained from an on-site 10 kV station, fed by the public grid, and 
is transported to the transformers which are located on the RID site. The transformers 
supply the main distribution box, which in turn supplies several distribution cabinets in the 
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institute. The electricity grid provides 400 V AC and 230 V AC. Figure 5.1 presents the basic 
diagram of the network. The parts fed by the diesel generator are in red; separate 
distributions boxes are numbered and grouped by main boxes. 
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• • — i 
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Distribution 
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Figure 5-1: Diagram of the electrical power system 

By design, there is no electrical power needed for the HOR to achieve and to remain a safe 
shut down state in case of loss of electrical power. 

When there is a power failure a RSA (Reactor Scram), a RIS (Reactor Hall Isolation) and a 
BIS (Pool Isolation) take place. This means that the basic safety functions are met: 

• Reactivity control 

By automatic gravity driven insertion of the control rods when the electromagnetic 
coupling device de-energizes due to loss of power (RSA); 

• Cooling 

By dissipation of residual heat into the (isolated) pool by natural convection to the 
pool water (BIS); 

• Confinement 

By isolation through the "fail safe" isolation valves of 

• the pool in case of leakage or failure of fuel elements; 

• the reactor hall in case of increased airborne radioactivity. 
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Internal back-up provision 

For the event of loss of off-site power, parts of the three sections are backed-up by the 
diesel generator; a/o systems such as personnel locks, emergency lighting and 
instrumentation. Uninterrupted power supply is assured to the last two systems by the 
uninterrupted power system (batteries). 

For reasons of (re)operability, support systems, such as the frost prevention pump and the 
air-locks, are fed by the diesel generator. Appendix C lists those systems. 

5.1.1.1.2 Autonomy of the on-site power sources 

The autonomy period is defined as the time period that systems can provide their back-up 
function without on-site intervention or internal support e.g. switch over to other systems to 
supply water or diesel fuel in case the system under consideration runs out of stock. In this 
chapter only the autonomy period for electrical power supply is considered. 

AC power 

In case of loss of off-site power parts of the three sections of the electrical power system will 
be fed by the diesel generator in the generator building, see appendix A and B. 

Fuel is supplied to the diesel generator by a day tank (volume 0.65 m 3 , minimum stock 0.5 
m 3 ), backed by a main tank of 1 m 3 (minimum stock 0.5 m 3 ). Consumption of the diesel 
generator is approx. 0.08 m 3 /hour at full load. 

Every month operation of the diesel generator is tested and at the same time fuel stocks are 
checked and replenished. For this, an external supplier uses a Standard check list. However, 
during the monthly checks fuel stocks are always far above the minimum stock of 0.5 m3. 
There is no procedure for refuelling during operation of the diesel generator, nor are 
arrangements made to assure supply of diesel fuel during emergencies. 

DC power 

An un-interruptible power supply system (UPS) with batteries is available. This provides un- 
interrupted power to the instrumentation and the emergency lighting for the short period at 
switch over from public grid to power supply by the diesel generator. lts design back-up time 
is 1 hour. 

5.1.1.2 Loss off-site power and loss of the ordinary back-up AC power source 
5.1.1.2.1 Design provisions 

As indicated before, the three main safety functions do not depend on electrical power 
supply. Ultimately instrumentation for monitoring relies on the back-up batteries. 
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5.1.1.2.2 Battery capacity, duration and possibilities to recharge batteries 

Design capacity of the batteries to feed instrumentation is 1 hour. Recharging is possible 
when external grid or diesel generator are available. 

5.1.1.3 Loss off-site power, back-up AC power sources and permanently installed 
diverse back-up AC power sources 

5.1.1.3.1 Battery capacity, duration and possibilities to recharge batteries 

In the LOOP-SBO situation only batteries are available to provide during 1 hour power to 
instrumentation for monitoring and emergency lighting. 

5.1.1.3.2 Actions foreseen to arrange exceptional AC power supply from transportable or 
dedicated off-site source 

There are no provisions, means, procedures or alternative actions available or prepared to 
provide alternative off-site power supply. From a safety point of view, off-site power is not 
necessary for the reactor to remain in a safe shut down state. 

5.1.1.3.3 Competence and time needed to make necessary electrical connections 

Not applicable as no means are available. 

5.1.1.3.4 Time available to provide AC power and to restore core cooling before fuel 
damage 

Because cooling is provided passively by natural convection of pool water, the time available 
before fuel damage might start is the time until uncovering of the core starts. This will be 
discussed in paragraph 5.1.2.2.2. 

5.1.1.4 Conclusions on the adequacy of protection against loss of electrical power 

It is obvious that the HOR is designed to achieve and remain in a safe shut down state in 
case of loss of electrical power, without any interference from outside needed. With regard 
to the loss of electrical power, no additional measures are needed to maintain this state for a 
very long period. Without interference, this time is limited by the loss of cooling when pool 
water is not available anymore due to loss of coolant or evaporation and uncovering of the 
core starts. This issue is dealt with in paragraph 5.1.2.2.2. 

5.1.1.5 Measures to increase robustness of the plant in case of loss of electrical 
power 

Potential cliff-edge effects 

For LOOP or LOOP-SBO situations, there are no cliff-edge effects identified. 
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However, monitoring of the plants' state through information provided by available 
instrumentation, in case of LOOP-SBO, will be possible only during the 1 hour battery 
capacity. 

In case of LOOP this period will last 6 hours during diesel generator operation (given a 
minimum stock of 0.5 m 3 ), while control activities from the control room are maintained. This 
period can be prolonged by refuelling the diesel generators during operation. A refuelling 
procedure for this situation is not available. 

After 6 hours of diesel generator operation monitoring can be continued by one hour of 
battery capacity. 

In case the control room is not available, monitoring of the plants' state is possible: 

• through a monitoring desk in the Alarm Staff room next to the porters' lodge at the 
entrance of the RID building; 

• by the alternative Alarm Staff room, located at the "Lucht- en Ruimtevaart" (L&R) 
building) at the same LOOP conditions of the HOR, provided the L&R building has 
electrical power supplied. 

Extension of monitoring means and especially monitoring time will improve monitoring of the 
reactor during LOOP and/or SBO conditions; the need for this should be elaborated. 

Measures for improvement 

Possible measures to improve the robustness of the plant, mainly meaning improvement of 
monitoring and control of the plant shut down state during LOOP or LOOP-SBO: 

• Evaluate advantages of the introduction of a load reduction or load shedding 
programme in case diesel fuel saving is needed to extend operation time of the diesel 
generator when refuelling fails; 

• Investigate the needs for monitoring the condition of the HOR in LOOP and/or SBO 
situations, the availability of the diesel generator and UPS related to their (time- 
limited) capacity to supply power and assure monitoring; increase of the battery 
capacity might be possible; 

• Investigate possibilities to extend the monitoring capability in the alternate Alarm 
Staff Room (L&R building) by availability of measuring data and E-power; 

• Improve means for diesel fuel transfer from the main tank to the day tank and 
provide a procedure or instruction for refuelling of both tanks during emergencies 
and long term of loss of off-site power. 

5.1.2 Loss of the ultimate heat sink 

ENSREG defines the ultimate heat sink (UHS) as "a medium to which the residual heat from 
the reactor is transferred. In some cases a plant has a primary UHS, such as the sea or a 



CSAHOR 31-05-2013 v2 



103/162 



river, supplemented by an alternate UHS, for example a lake, a water table or the 
atmosphere". Characteristic for those media is that they are almost infinite and in their bulk 
not affected by the heat discharge. 



5.1.2.1 Plant cooling conditions 



The following plant states for normal operation can be defined: 

1. Normal power operation (weekly') 

a. Cooling is provided by the 
primary and secondary 
cooling system in case the 
reactor power exceeds 
750 kW. The heat is 
discharged to the open 
air; 

b. The core is cooled by 
natural convection to the 
pool water for reactor 
power operation less than 
750kW. Ultimately the 




■■■■ 



heat dissipated to and stored in the pool will be removed by the primary and 
secondary cooling system to the open air. (Although part of it will be discharged 
to the reactor hall atmosphere and removed by the ventilation system). 

Normal shut down (after the weekly operation, RSA or 

during longer outage periods) 



Residual heat is dissipated into the pool by natural 
convection to the pool water. When the pool water 
temperature is increased, heat is removed by the primary 
and secondary cooling system and discharged to the open 



□ 



air. 



5.1.2.2 The ultimate heat sink and alternate ultimate 
heat sink 



Based on the ENSREG definition and the defined (possible) plant states the ultimate heat 
sink of the HOR is provided by the open air. Because for both operational states ultimately 
the heat is dissipated to the open air; for power operation (more than 750kW) immediately 
and for low power operation (less than 750kW) and shut down after intermediate storage in 
the pool, by the combination of primary and secondary system. The cooling towers provide 
the last part of this cooling train. 
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An alternate ultimate heat sink, as it is indicated by ENSREG, does not exist at the RID site. 
However the pool, although ultimately not infinite, provides alternate cooling and can be 
considered as back up for the UHS. It will be dealt with under this denominator. 

In case of loss of UHS, heat discharge from the core to the pool will cause a temperature 
increase of the pool. Then boiling starts. Ultimately this might result in uncovering of the 
core. If this happens two situations can be distinguished: 

1. Partly uncovering of the core 

Heat of that part of core that is still covered by water will be 
removed by convection to the pool water; the uncovered part 
will be cooled by conduction of heat to the covered, and cooled 
part of the core. 



i- 
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2. Complete uncovering of the c ore 

When the water level drops below the bottom of the core, 
cooling will be provided by natural convection to the air of the 
reactor hall. 



Appendix D presents the decay heat curve of the HOR after shut down at 3 MW including the 
heat load posed by the stored spent fuel elements. Based on this curve boil-off of the pool 
water is assessed. When only this boil-off is taken into account and heating up the pool to 
100°C is neglected, it is concluded that it takes boiling of approx. 160 m 3 of pool water to 
remove the decay heat for the first 3 years 12 . 




5.1.2.3 Design provisions to prevent the loss of the primary ultimate heat sink 

Discharge of the residual heat of the reactor is provided by the combination of primary 
system and secondary system, after intermediate storage of this heat in the reactor pool. 



In the situation that section 1 and 2 are separated by the pool door and the core resides in section 
1 (as is usual) only approx. 60 m 3 is available for boil-off until uncovering of the core starts; this will 
take approx. 250 days: cooling of the spent fuel in section 2 (less decay heat (1,5 MW see appendix 
D , more water available (approx. 100 m 3 ) will exceed those 3 years 
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Because the heat storage capacity of the pool is very large no additional means are needed 
so not provided for cooling of the pool water. 

5.1.2.4 Loss of the primary ultimate heat sink 

Loss of the ultimate heat sink (LUHS) for the HOR means that there will be no heat transfer 
to the open air via the secondary cooling system (no heat discharge by the cooling towers). 

5.1.2.4.1 Availability of an alternate heat sink 

It is assumed that for the HOR the pool will act as alternate ultimate heat sink, although it is 
ultimately not infinite. Cooling is provided by dissipation of the residual heat into the pool 
water. It is shown that the heat processing capacity of the pool (absorption by heating up 
and boil off) is sufficiënt to remove residual heat of the core for at least 3 years. 

5.1.2.4.2 Possible time constraints for availability of alternate heat sink and possibilities 
to increase the available time 

It is shown, see appendix D, that after 3 years the core is still covered by pool water, so heat 
is still dissipated. 

5.1.2.5 Loss of the primary ultimate heat sink and the alternate heat sink 

Loss of alternate heat sink (LAHS) means loss of the pool water. In this case there will be no 
ultimate heat sink operable because there are no means of heat transfer to this heat sink. So 
loss of the alternate heat sink means also loss of the ultimate heat sink. 

In case of a postulated loss of alternate heat sink by loss of coolant, opposite to the slow 
procedure of heat-up and boil-off of the pool water, the water level may drop rapidly and 
(partly) uncovering of the core may start very soon, as presented in 5.1.2.2. It is not clear 
whether cooling of the core by water and/or air is sufficiënt to prevent fuel damage. Cooling 
possibilities for both situations have to be elaborated. First, when the core is partly covered 
by water and heat is removed by convection to and boil-off of water. Second, when the core 
is completely drained and cooling has to be performed by natural convection of 
(containment) air. 

5.1.2.5.1 External actions foreseen to prevent fuel degradation 

In case of loss of pool water, it is anticipated that water will be supplemented from the fire 
fighting system through a connection to the water storage tank of the pool. Means, 
connection pipe, are available; a procedure to perform this action is not available. 
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5.1.2.5.2 Time available to restore core cooling before fuel damage 

It is indicated that in case of loss of pool water due to a break of the coolant line at the 
bottom of the pool, time until full uncovering of the core is 30 minutes. It is unclear whether 
connecting the fire fighting system and the water storage tank can be established in time 
and whether it is of sufficiënt capacity to replenish the pool up to core covering level. 
Alternatively, acceptance of draining of the pool and starting of cooling of the core by air is 
still under discussion and has to be elaborated. 

5.1.2.6 Conclusions of the adequacy of protection against loss of ultimate heat 
sink 

Because back-up of the UHS by the pool assures long term processing of the residual heat, 
the plant is adequate protected against this event. 

5.1.2.7 Measures to increase robustness of the plant in case of loss of ultimate 
heat sink 

Potential cliff-edge effects 

For LUHS no cliff-edges are identified. 

For LAHS the following potential cliff-edges can be identified: 

• Failure to replenish pool water in time, leading to uncovering of the core ; 

• Failure to cool a partly uncovered core by water or a complete uncovered core by air. 

Measures for improvement 

First of all the possibilities of loss of coolant, and thus the loss of the alternate heat sink, 
should be elaborated. In case this event can be excluded, e.g. by demonstration of the 
robustness of the doublé walled pipe-connections to the bottom of the pool and the 
robustness of the isolation valves, LAHS as an initiating event can be excluded. Enhancement 
of this robustness may be improved by introduction of additional leak detection or 
application of the leak-before-break principle. 

Secondly, the situations for cooling of the core by water when partly covered by water, or 
cooling of the core by air when completely uncovered, should be elaborated. Results can 
vary from conclusions that cooling is always assured, that cooling is effective given certain 
pre-conditions (e.g. start after a certain decay time) or that cooling in this way is not 
effective. For the first situation no cliff-edges remain, for the intermediate situation 
additional measures might be needed as they will be necessary for the last situation. 

For the last two situations, in case cooling by water and/or air might be insufficiënt, the 
following measures might provide possible improvement of the plants' robustness: 
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1. Because it is anticipated that supply by the fire fighting system may not completely 
compensate for loss of coolant (leakage and/or boil-off), a core spray that is 
independent of the loss rate, may be installed instead of direct supply to the pool via 
the water storage tank; 

2. To prevent draining of the pool in case of pipe-break immediate underneath the 
connection to the pool, measures should be investigated to isolate this kind of 
leakages. 

Additionally, isolation of the affected pool section by closing the pool door may be possible. 
For this situation either the core or the stored spent fuel or both have to be relocated to the 
unaffected pool section before the pool door will be closed. For core transfer from section 1 
to section 2 and relocation from section 2 to section 1 an instruction exists; implementation 
of this instruction should be checked, see section 6.2.3. 

Finally, procedures or instructions shall be provided to: 

• replenish pool water by supply of water stored in several tanks inside RID; 

• implement supply of water to the storage tank by the fire fighting system. 

5.1.3 Loss of the primary ultimate heat sink, combined with station black out 

Removal of residual heat of the core during LUHS is provided by the dissipation of that heat 
into the pool. This is completely independent of the electrical power supply. This means that 
loss of ultimate heat sink in combination with station black out is identical to the situation of 
loss of ultimate heat sink. 

5.1.3.1 Time of autonomy of the site before loss of normal reactor core cooling 
conditions 

This is identical to the situation of loss of ultimate heat sink, see 5.1.2.2.2. 

5.1.3.2 External actions foreseen to prevent fuel degradation 

Not applicable 

5.1.3.3 Measures to increase robustness of the plant in case of loss of primary 
ultimate heat sink, combined with station black out 

The combination of LUHS and SBO with respect to heat removal is identical to the LUHS 
situation. Therefore, compared to the LUHS situation, no additional measures to increase the 
robustness of the reactor have to be proposed. 
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5.2 Spent fuel storage pools 



Spent fuel is stored in the pool. This means that decay heat generated by spent fuel is 
dissipated directly into the pool that is part of the primary system. 

Therefore, methods and systems for heat removal of the spent fuel are the same as for core 
cooling. 

5.2.1 Loss of electrical power 

5.2.1.1 Measures to increase robustness of the plant in case of loss of loss of 
electrical power 

Measures are identical to those proposed for the reactor, see 5.1.1.5 

5.2.2 Loss of the ultimate heat sink 

5.2.2.1 Measures to increase robustness of the plant in case of loss of ultimate 
heat sink 

As far as applicable, these measures are identical to those proposed for the LUHS situation 
of the reactor, see 5.1.2.5. 

It is noticed that 

1. Spray of spent fuel may not be necessary, because conditions are less severe than 
for uncovering of the core; 

2. For the situation that section 2 of the pool is drained, this situation is in reverse of 
draining of section 1. For the situation that the core is in section 2 a procedure 
indicating that the core should be moved to section 1 and the pool door should be 
closed is at hand. Replacement of spent fuel is not indicated, this might not be 
necessary as cooling conditions are less severe. However, to anticipate this event, an 
instruction for replacement of the spent fuel for this situation should be added to this 
procedure. As indicated in 5.1.2.7 implementation of such an instruction should be 
checked, see also 6.2.3. 

For both situations cooling by air might be sufficiënt; this should be part of the elaboration of 
the core cooling by air. 

5.2.3 Loss of the primary ultimate heat sink, combined with station black out 

5.2.3.1 Measures to increase robustness of the plant in case of loss of primary 
ultimate heat sink, combined with station black out 

The same requirement as for LUHS, see 5.1.3.3, applies. 
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5.3 Supplementary consequences 

ENSREG indicates that an assessment should be made for the situation that cliff-edges will 
occur and will result in loss of all means to mitigate the plant conditions dealt with in this 
report, so fuel damage or core degradation will result. The most severe events, in this 
context are the events that back-up of the LUHS (by pool water or air cooling) is not 
available or inadequate. 

In these situations ultimately core cooling will be insufficiënt and core heat-up will start. 
Then core degradation cannot be excluded, so release of radioactivity into the containment 
will occur. 

The timeframe of these events depends on the sequence that water depletion is caused by 
leakage and the speed that water is lost, so the time that uncovering of the core starts. 

Succession of these events is included in severe accident management procedures. 
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6 Severe accidents management 



6.1 Organization and arrangement of the licensee to manage accidents 

6.1.1 Organization of the licensee to manage the accident 

The Reactor Institute Delft (RID) is part of the Faculty of Applied Sciences of the Delft 
University of Technology. The RID operates one research reactor: the Hoger Onderwijs 
Reactor (HOR). According to the Dutch Nuclear act, the Executive Board of the university, 
being the licensee, is responsible for the HOR. 

Being the Operator of the HOR, the RID is responsible for its safety. In general the RID 
operations are conducted conform the RID managements system 

(Kwaliteitsmanagementsysteem RID). Normal operating procedures and the Operating Limits 
and Conditions (OLCs) form the basis for safe operation. For accidents additional provisions 
are made. The RID is responsible for the organization of the on-site emergency response as 
well as for providing plant or site-status information to the local response team, authorities 
and regulator; this to enable organizations in charge to initiate possible regional or national 
emergency response. 

The Emergency Response Organization (ERO) of RID as a whole (including supporting 
departments) is described in the RID Emergency Plan ("Bedrijfsnoodplan"). This RID 
Emergency plan describes how the RID organization will respond to an emergency situation. 
After an alarm or incident the first response is handled by the ERO or by the 
"Bedrijfshulpverleningsorganisatie" (BHVO). The RID Radiation Protection Department 
("Stralingsbeschermingsdienst / SBD") takes part in of the ERO. In the first phase of an 
incident a Policy Team is formed. This policy team coordinates activities of the ERO, 
Radiation Protection Department, the local emergency services and authorities. Coordination 
within the ERO is arranged via the coordinating activity called the "motorkapoverleg". The 
complete ERO organization is shown in Figure 6-1. Note that the RID organization is referred 
to as IRI, the former name of the institute and that emergency classification will determine 
the involvement of local and regional emergency services and authorities. 
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Figure 6-1: Complete Emergency Response Organization (ERO) from RID (former IRI) 

A list of abbreviations of the organizations involved in the ERO is shown below. 



AC 


Emergency Centre TU Delft 


BHV 


Emergency Services 


Brw 


Fire brigade 


BT 


Policy Team RID TU Delft 


CMD 


Commander 


CVD 


Commander of Service 


CTPI 


Coordination Team Place of Incident 


GGD 


Public Health Service 


OVD 


Duty Officer 


ROGS 


Regional Officer Hazardous Substances 


SBD 


Radiation Protection Service RID TU Delft 


TD 


Technical Service RID TU Delft 


VBP 


Extended Base Package 


VPH 


Head Collecting Station 


IVD 


Inspector of Duty 


IRI 


Former RID 


TML 


Additional Medical Liaison 



Whereas the RID emergency plan describes the Emergency Response Organization of the 
whole institute during an emergency situation, specifically for the HOR and its operations 
team a set of procedures and instructions is available. The emergency procedures of the 
HOR describe which instructions to follow during an emergency situation and its 
administrative settlement afterwards. The emergency instructions describe the technical 
actions that the operations team has to perform to bring and maintain the reactor into a safe 
shutdown state and to ensure cooling and confinement. 
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6.1.1.1 Staffing and shift management in normal operation 

During normal operation from Monday until Friday the control room is permanently staffed 
with operator teams with a minimum of 2 persons in 3 daily shifts. During the weekend the 
reactor is kept in cold shut down condition and staff is available in emergency cases by 
means of consignation. An overview of the consignments is shown in Table 6-1. 



Table 6-1: Consignees outside normal operation 



Department 


Consignee 


Reactor Supervisor* 


Staff member HOR-B or HOR-O 


SBD Supervisor 


Member of SBD 


Weekend Supervisor 


Head of conciërge or replacement 


Fire Supervisor 


Chef Control Group HOR-B 


TD Supervisor 


Member of TD 



*) only during Reactor Operation 



The RID security lodge, where access to the RID buildings including the HOR is controlled, is 
permanently staffed by security personnel. This security lodge also houses the Central Alarm 
Control Room of the complete Delft University premises. 

6.1.1.2 Plans for strengthening the site organization for accident management 

The RID Emergency plan and the Regional Emergency Plan RID are evaluated and updated 
on a regular basis. 

6.1.1.3 Measures taken to enable optimum intervention by personnel 

The ERO is defined in the RID Emergency Plan, by which personnel is directed to perform 
emergency actions during emergency situations. Emergency actions depend on the scenario; 
two main scenarios are defined: 

Scenario A: Emergency with possible radioactive release into the reactor building; 

Scenario B: Emergency with a fire in the laboratory with possible release of 
radionuclides. 

For a B scenario no additional measures are foreseen outside the RID premises other than 
the Standard instructions to the Fire Brigade and Police. An A scenario could necessitate 
external measures. 
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The ERO has been tuned with the Regional Response Plan of Delft 
("Rampenbestrijdingsplan") and the national crisis organization as defined in the National 
Plan for Nuclear Emergency Planning and Response (NPK, not specifically related to the HOR 
but to all nuclear facilities). The Emergency Response Plan of RID was established in a 
covenant between the Mayor of Delft and the Director of RID, and submitted to the 
Authorities (KFD). 

The coordination via the RID Policy Team and RID Liaison with the (local) authorities is 
shown in Figure 6-1. Note that the RID organization is referred to as IRI, the former name of 
the institute. Regular meetings between local authorities and the RID are held in order to 
keep the Regional and RID emergency plans (i.e. "Rampenbestrijdingsplan") resp. 
"Bedrijfsnoodplan" synchronized. Improvement actions are initiated in these meetings. The 
emergency plans and organizations have been changed several times in order to cope with 
new developments in responsibilities and in the local response organizations. On-site training 
exercises are organized together with the Fire Brigade, Police and Ambulance-services. 

The RID Emergency Plan describes how different parts of the ERO act in different emergency 
situations a/o.: 

• First aid; 

• Dealing with alarm signals (fire, radioactivity); 

• Containment isolation and evacuation; 

• Onsite evacuation; 

• Monitoring of plant status and communication (internally and externally). 

6.1.1.4 Use of off-site technical support for accident management 

Off-site technical support is provided by regional facilities, such as fire brigades. The 
organization of off-site support is described in the aforementioned emergency plans. A RID 
liaison in the regional crisis organization will be responsible for coordination with external 
parties. 

In case of an accident the RID site is accessible via the main entrance (gate West of the 
reactor site), see Figure 6-2. For RID the following response times are used for the 
emergency services: 

• Fire brigade 8 minutes - After an alarm period of 3 minutes with no counter action 
on-site, the alarm is automatically forwarded to the fire brigade 'Haaglanden'. Their 
response time is 5 minutes; 

• Police 5 minutes; 

• Ambulance max. 15 minutes. 
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An additional entrance is available at the North side of the RID site. Access via this route is 
limited for large and heavy vehicles (e.g. Fire Trucks) because of tight corners and unstable 
ground. 

The National Authorities can, according to agreements in the NPK, provide additional means 
through the RIVM 13 and military services. A special team for 'dangerous goods' ("gevaarlijke 
stoffen team") is available on a national level. This team is located in The Hague and can be 
on site in 20 minutes. Among others, this team is equipped with 'HazMat' (hazardous 
material) suits and cleaning equipment for cleaning contaminated people. 




Rijksinstituut voor volksgezondheid en milieu (Governmental Institute for Public Health and the 
Environment 
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6.1.1.5 Procedures, training and exercises 

The skills and emergency preparedness of the RID ERO is maintained by regular checks and 
training exercises. The alarm systems are tested on a periodic basis. The training and 
checkup program consists of the following actions: 

• Members of the Policy Team (BT) and Radiation Protection Department 
(Stralingsbeschermingsdienst-SBD) exercise at least 4 times a year; 

• Members of the ERO (BHV) exercise at least 10 times a year; 

• The call-up signal of the ERO (BHV) is exercised at least 6 times a year; 

• The building alarm procedure is exercised at least once a year by all attendees during 
the alarm test; 

• The functioning of the building alarm signal is tested every month; 

• The functioning of the Hall alarm / call-up signal is tested during every reactor check- 
out before starting up the reactor after the weekend;. 

• The functioning of the Fire Alarm system and the communication connection with the 
regional fire brigade is tested on a weekly basis. 

All functional tests are recorded in a log book. The performance is evaluated with the RID 
Head of the Program for Safety and Health (H.PVM) and the ERO (BHVO) after every 
exercise. If necessary, updates of the RID Emergency Plan will be initiated. 

The connection between the different plans and the HOR procedures is shown in Figure 6-3. 
The RID Emergency plan describes how the organization should respond in an emergency 
situation and takes care of the RID personnel. The HOR Emergency Procedures give 
guidelines to operator personnel how to respond in emergency situations. The instructions 
for operator personnel are detailed descriptions of how to handle emergency situations. RID 
is currently revising these procedures and instructions including the document structure in 
order to improve the transparency and user-friendliness. 
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National Reponse 
Plan* (NPK) 



RID Emergency Plan 
("Bedrijfsnoodplan") 



Emergency 
Procedures HOR 



Emergency 
Instructions HOR 




Regional Response Plan RID 
("Rampenbestrijdingsplan") 



I 



Plan of Approach 
"Aanvalsplan Brandweer" 



*Note 

The NPK covers all nuclear 
facilities in the Netherlands 
and is not specifically 
dedicated to the HOR 



Figure 6-3: Connection between Emergency Plans for the HOR 



6.1.2 Possibility to use existing equipment 
6.1.2.1 Provisions to use mobile devices 



No dedicated provisions for using mobile devices such as generators and pumps are foreseen 
because they are not deemed necessary for the HOR. The HOR is not depending on 
electrical power and active cooling for maintaining the basic safety functions (criticality, 
cooling and confinement). However, a Standard package of equipment is available for the 
ERO: Self-Contained Breathing Apparatus (5 sets), Porto phones (7), First aid kits and 
Pagers. A small forklift truck and small lorries (from facility services) are available onsite for 
local transport and lifting of material. Standard mobile equipment can be provided by the 
local fire brigade such as pumping trucks, mobile pumps and mobile generators and lighting 
equipment. 

6.1.2.2 Provisions for and management of supplies 

For safe shut down of the reactor no external or emergency power sources are needed. For, 
e.g. monitoring and control functions as well as support systems, a diesel generator (280 
kW) and UPS system are installed. The UPS is able to provide power to the reactor status 
monitoring for 1 hour. The maximum total diesel storage capacity for the diesel generator is 
1.65 m 3 (1 m 3 storage tank and 0.65 m 3 day tank.) The generator is checked-out monthly by 
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an external service provider. The day tank is filled when the level drops below 0.5 m 3 . The 
storage tank is also filled when the level drops below 0.5 m 3 . So the minimum present diesel 
storage is 1 m 3 and provides generation capacity for 12.5 hours 14 (diesel consumption at 
rated power is 0.08 m 3 /h). Note that there is no connection between the day and storage 
tank. Filling and level checking must be done manually. The procedures for maintenance and 
checking are arranged centrally via the FMVG (Facilities Management and Real Estate) of the 
Delft University and the FMVG has contracted this work to an external service provider. 

Provision of food to RID staff is arranged via the central Catering Services. No specific 
provision in case of emergency is arranged. 

6.1.2.3 Management of radioactive releases, provisions to limit them 

The monitoring and supervision of possible radioactive releases rests at the radiation 
protection service of the RID. They are provided with measuring data via the continuous on- 
site monitoring system. This monitoring system called Central Registration System (CRS) 
consists of 20 channels for measuring the following quantities: 

• Radio-activity in (ventilation) air; 

• Radio-activity in disposal water in the collection tanks; 

• Exposure rate; 

• Wind speed and wind direction. 

The containment provides limited shielding and isolation of possible radioactive releases. The 
procedures for Containment Isolation and Pool Isolation in order to prevent releases into the 
environment are laid down in the RID Emergency Instructions. In order to maintain the 
containment integrity after isolation (e.g. during changes in outside atmospheric weather 
conditions), the pressure shall be kept below the design pressure. The design pressure of 
the containment is 10 kPa (over pressure) and 1 kPa under pressure. The Water Seal is 
designed to 'break' at 10 kPa overpressure resp. 1 kPa under pressure. As described in the 
Plan of Approach and the RID procedure "AFLATEN HALLUCHT BIJ CALAMITEIT", pressure 
shall be relieved via the gas meter bypass and subsequently the ventilation stack when the 
containment overpressure exceeds 1 kPa (10 cm water column) respectively 'approaches 10 
kPa'. The containment leak rate is tested on a regular basis. 



Opposite to the assumptions of chapters 1 and 5 that only the minimum stock of the day tank is 
available, for SAM it is accepted to suppose refueling of the day tank by the minimum stock of the 
storage tank 
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At containment over pressures above 10 kPa uncontrolled pressure reliëf will take place via 
the water seal. The containment has been tested at a pressure test of 11 kPa after finishing 
construction. So there is margin with respect to the design pressure. 

Since the RID has an 'open pool' type reactor with low or atmospheric pressure, no 
containment pressure rise is to be expected as a result of a LOCA. In case of Loss of 
Ultimate Heat Sink (LUHS) the pool temperature could increase slowly, ultimately leading to 
a situation of long term water evaporation of the pool (see Section 5). Since the heat input is 
relatively low compared to the containment size and heat transfer surface, no over pressure 
is expected in this situation. 

6.1.2.4 Communication and information systems 

Within the RID emergency plan a number of communication and information systems are 
defined which are tested and trained on a regular basis, comprising: 

• Building communication system; 

• Intercom RID Radiation Protection Service; 

• Intercom HOR; 

• Pager Installation including Semaphones / Buzzers; 

• Porto phones; 

• GSMs; 

• Internal and external phone connections; 

• Direct communication line between Alarm Centre-TUD and the Regional Alarm Centre 
(Haaglanden). 

In addition, the RID has an alternative Alarm Staff Room in the Aerospace Technology 
building (L&R). From this room information on the status of the reactor and the onsite 
radiation monitoring system is available online (live). 

The external communication with Local Authorities depends on the type of emergency 
scenario as laid down in the RID Emergency Plan: 

• Scenario A: Emergency with possible radioactive release into the containment 
building; 

• Scenario B: Emergency with a fire in the laboratory with possible release of 
radionuclides; 
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6.1.3 Evaluation of factors that may impede accident management and 
respective contingencies 

6.1.3.1 Extensive destruction of infrastructure or flooding around the installation 
that hinders access to the site 

The RID can be reached via several main roads and a large number of local roads. In case of 
blockage of the main roads A13 and N470, alternative routes are possible, for instance via 
the A4 or N468 in the west. 

When the main gate on the West side is blocked, site access is available via the smaller 
North entrance. However, this entrance has limited capacity in terms of heavy load and large 
vehicles. 

The RID Alarm Staff Room at the Faculty of Aerospace Technology is located at elevated 
level (8 th floor), hence this facility will still be available in case of flooding of the site. 

It has to be noted that due to the low level of residual heat of the reactor after shut down, 
the dependence on local infrastructure for electrical power and active water cooling is very 
limited. There are no additional provisions for access to the site in case of extensive damage 
of infrastructure. 

6.1.3.2 Loss of Communications facilities / systems 

Normally no communication is needed to maintain safe shut down conditions. However, 
communication is essential when there is an emergency that requires intervention of 
auxiliary services such as the fire brigade or authorities. Communication in such cases is 
arranged via the RID emergency plan. A list of available communication tools is shown in 
section 6.1.2.4. No specific loss of communication scenario has been evaluated. 

6.1.3.3 Impairment of work performance due to high local dose rates, radioactive 
contamination and destruction of some facilities on site 

In case of a radioactive release into the containment, the containment will be evacuated. For 
the 'enveloping accident' as described in the Safety Report, no large scale off-site evacuation 
is needed. Depending on the severity of the release the evacuation is mainly limited to onsite 
evacuation. Work in and near the containment will be impaired. In the event of an airplane 
crash directly into the containment building the site will be evacuated up to several hundred 
meters from the reactor building. In first place action will be initiated according to an A- 
scenario in the RID and Regional Emergency Plan. 
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6.1.3.4 Impact on the accessibility and habitability of the main and secondary 
control rooms, measures to be taken to avoid or manage this situation 

Normally no operator actions are needed to maintain safe shut down conditions. The main 
control room is attached to the containment. There is no additional shielding between the 
control room and the containment, besides the containment and control room structure 
itself. In case of a significant radioactive release into the containment, the control room 
needs to be evacuated according to dedicated instructions. The RID emergency plan will 
initiate evacuation and the HOR Emergency Instructions give guidance to the operators how 
to act in this situation. The Alarm Staff Room and alternative Alarm Staff Room are provided 
with essential monitoring data from the reactor (status information) and are therefore 
considered 'secondary control rooms'. 

In Table 6-2 a general overview is given of the availability of the Main Control Room, the 
Alarm Staff Room inside RID (0.K0.200) and the alternative Alarm Staff Room in TUD 
Aerospace Technology on the 8th floor in case of different external hazards. 



Table 6-2: Impairment of rooms or buildings due to external hazards 



Room 


External Hazard 


Flooding 


Earthquake 


Fire at HOR/RID 


Extreme Weather 


Aircraft Crash 
HOR/RID 


Explosion 


RA Release 
>A-B Scenario 


Main Control 
Room 


+ 


+* 




+* 




R 




RID ERO Room 


-/+ 


+* 




+* 




R 




ERO/ 
Monitoring 
Room: TUD 
Aero Tech. 8 th 
floor 




- 






+ 


R 


+ 



= Vulnerable, "+" = Available, "R" = Redundant, * = based on existing building & construction 
codes, no specific analyses available. 



In case of a significant dose rate on the RID premises due to an event in the HOR, the 
alternative Alarm Staff Room is still taken to be available. No accident management activities 
under these conditions are foreseen by control room operators. The RID Alarm Staff Room 
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(0.K0.200) will be available in case of flooding levels below 0.26m NAP. In case of an 
explosion with local effects it is expected that one of the rooms will be available; hence their 
qualification 'Redundant'. Since the seismic activity in this area is low, no seismic design 
analyses have been performed in the construction phase. Based on the existing building 
regulations and the low seismic activity it is expected that the Control Room and Alarm Staff 
Rooms will stay available in case of a seismic event. Extreme weather (e.g. heavy storms, 
heavy rain) are taken to be covered by the existing building & construction codes, and 
therefore assumed to be available as well. 

It is concluded that in case of external hazards at least one control room is available. 

6.1.3.5 Impact of the different premises used by the crisis teams or for which 
access wou ld be necessary for management of the accident 

The premises used by crisis teams are shown in Table 6-2. No specific accident management 
activities are foreseen to maintain the basic safety functions because of the relatively robust 
design of the HOR. As explained in paragraph 6.1.3.1 the RID site is accessible from 
different directions (North and West). At least one of the Alarm Staff Rooms will remain 
available. 

6.1.3.6 Feasibility and effectiveness of accident management measures under the 
conditions of external hazards (earthquakes, floods) 

No specific accident management procedures are foreseen. Possible activities to restore 
power for monitoring and control functions may be impaired due to flooding or earthquake 
related damage. Potential efforts to refill the Reactor Pool 15 after an extreme event may be 
impaired by infrastructural damage (i.e. fire fighters with pumping trucks are not available, 
while water from tapping points may be available still). In case of flooding, the reactor will 
be shut down well in advance since the flooding scenario's for RID are slow (see Section 3 
Flooding). No specific safety issue is expected in that situation. 

6.1.3.7 Unavailability of power supply 

The HOR is not depending on electrical power for maintaining the basic safety functions 
(Cooling, Confinement and Criticality). However, if the diesel generator and/or UPS are not 
available, there is no status information of the reactor available. In case of Loss of offsite 
power, AC power from the Diesel generator is available in the Alarm Staff Room for 



Refilling of the reactor pool may not be necessary, depending on the outcome of a study on the 
cool ability of the fuel, see Chapter 5. 
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monitoring and lighting. The alternative Alarm Staff Room nas no power connection with the 
diesel generator. Lighting and status information will not be available in this room after loss 
of off-site power of this room. In case of loss of off-site power, the radiation protection 
department (SBD) can use the handheld radiation monitors from their Standard equipment 
package. 

6.1.3.8 Potential failure of instrumentation 

The flooding and earthquake resistance of all instrumentation is not known. The most likely 
failure mechanism for the instrumentation will be the loss of power supply (see section 
6.1.3.7). 

6.1.3.9 Potential effects from the other neighbouring installations at site 

There are no other units onsite. A fire or small explosion in a neighboring building with 
laboratories may limit accessibility. However, since the HOR is not depending on accessibility 
or power for maintaining safe shutdown conditions, this scenario itself will not compromise 
reactor safety. 

6.1.4 Conclusion of the adequacy of organizational issues for accident 
management 

The RID emergency response organization (ERO) is described in the RID emergency plan 
and covers a wide range of emergency scenario's by giving directions to who is responsible 
for the issues involved; first aid, fire, radiological and technological aspects. Proper actions 
shall be taken by these responsible persons. If needed, additional assistance will be provided 
by local emergency services. This is trained and plans are updated on a regular basis, as laid 
down in the RID emergency plan. The larger part of the actions are related to first aid, 
firefighting, evacuation and monitoring. On this basis it can be concluded that the 
organizational issues for accident management are adequate. 

However, no provisions are made for possible actions to restore safety functions or mitigate 
consequences as a result of an extreme event, possibly with high dose rates. On the other 
hand, the HOR proves to be very robust. 

6.1.5 Measures to enhance accident management capabilities 

• Revise and clarify organizational chart in the RID Emergency Plan (e.g. replace IRI by 
RID); 

• Make an inventory of equipment of Fire Brigade Haaglanden and adjust plans for 
possible emergency provisions (e.g. additional power connection for monitoring 
functions, water connection for refilling reactor pool); 

• Both procedures for containment pressure reliëf in "Bedrijfsnoodprocedures" and the 
"Aanvalsplan" may be checked on consistency (1 kPa versus approaching 10 kPa) and 
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effectiveness. Add the instruction that consultation of the Radiation Protection 
Department (SBD) is needed about internal recirculation over the filters in order to 
reduce release fractions before pressure reliëf; 

• Investigate the need and possibility to have an additional procedure for fast and 
continuous provision of diesel to the diesel generator tanks in case of extended loss 
of off-site power. This is now arranged via a general contract of FMVG (Facility 
Services) on a monthly basis; 

• Check the preparedness of local emergency services (e.g. Ambulance personnel) for 
radiological events. 

6.2 Accident management measures in place al the loss of core cooling 
function 

The reactor pool does not need active cooling in shutdown conditions because of the large 
heat capacity of the reactor pool compared to the decay heat of the core. In case of loss or 
depletion of pool water, actions may be necessary to keep the reactor core covered and 
cooled by water. It has to be remarked that (partial) uncovering of the core leads to high 
local dose rates but partly cooling by water and air may provide sufficiënt cooling to keep the 
fuel from degradation (see chapter 5). 

6.2.1 Before occurrence of fuel damage 

The RID emergency instructions provide instructions in case of a Reactor Pool LOCA 16 . The 
reactor pool is divided into 2 sections which can be isolated by a pool section door. 
Operation of the HOR is only possible with the pool section door in open position. In case of 
a LOCA in one of the two sections, the core can be transferred to the intact section and 
isolated by closing the pool door, provided that there is enough time to perform this action 
(depending on the LOCA size). The spent fuel is not mentioned in these instructions because 
this fuel is taken to be "decayed and cooled" enough to be sufficiently cooled by air. It is 
recommended to analyze this ability to cool further (see recommendation chapter 5). It must 
be noted that the polar crane is not connected to the Diesel generator. The crane cannot be 
credited for accident management inside the containment after loss of off-site power. The 
emergency instruction for relocating the core is assumed to be performed by manual actions. 
For spent fuel relocation this situation is to be analyzed. 



A scenario with a water 'leak' is normally referred to as a Loss of Coolant Accident (LOCA) 
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There is a possibility to fill the Reactor Pool via a connection on the water storage tank with 
a fire fighting connection. Hardware provisions are available and it is foreseen to develop a 
procedure. 

In addition, 4 water hydrants are available onsite to provide water for fire fighting or cooling 
(see Figure 6-2). The canal around the HOR site at 1 km distance provides an additional 
water source for mobile (fire) pumps. The canal is connected to the Schie pumping station 
via several canals. Therefore the supply of water can be maintained for a long period. For 
the availability of fire pumps the RID depends on the fire brigade, since no equipment is 
available onsite. 

6.2.2 After occurrence of fuel damage 

In case of fuel damage, no specific procedures are available except for the approach 
according to an A or B scenario. This approach covers a/o. evacuation, fire fighting and 
communication according to the RID emergency plan. 

External water connections in combination with procedures should enhance the capability of 
restoring core cooling / mitigate the consequences in case of a LOCA. 

6.2.3 Measures to increase the accident management in case of loss of core 
cooling function 

• It is foreseen to develop a procedure for refilling the water storage tank for adding 
water to the pool in case of a low level. Training and testing should be defined in this 
procedure as well; 

• For the relocation of the core to the other pool section in case of loss of pool water, 
the handling time and dependence on tools or equipment should be evaluated by 
performing a training exercise of the existing emergency instruction. The required 
time will determine the leak rate that can be handled. The identified tools, 
dependencies (e.g. E-power for polar crane for spent fuel relocation) and expected 
dose rates will make it clear in what situations relocation is an option; 

• The instruction on core relocation in case of a leak in pool section 2 should be 
complemented by guidance on the handling of spent fuel (depending on their ability 
to cool in air without degradation, see also recommendation Chapter 5). 

6.3 Maintaining containment integrity after fuel damage in the reactor 
core 

6.3.1 Elimination of fuel damage / meltdown in high pressure 

The HOR is an open pool reactor which operates under atmospheric pressure. Hence, high 
pressure core melt is excluded on physical grounds. 
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6.3.2 Management of hydrogen risks inside the containment 

Hydrogen production by oxidation of the zirconium fuel cladding at high temperature is 
excluded for the HOR since the HOR has fuel with Aluminium cladding. 

6.3.3 Prevention of overpressure of the containment 

Overpressure of the containment may lead to loss of the containment. This should be 
prevented by all means since it is the last of the four barriers (fuel matrix, fuel cladding, 
primary circuit and containment) to prevent possible radioactive release to the environment. 

6.3.3.1 Design provisions 

The integrity of the containment of the HOR is safeguarded by the passive water seal that 
will reliëf pressure above a pressure difference of 10 kPa or under pressure of 1 kPa between 
the inside of the containment and the outside. After pressure reliëf the confinement function 
of the containment is limited since there is an opening to the environment via the open 
water seal. 

An internal explosion is not expected because of the absence of a combustible fuel source 
and/or pressurized (steam) systems. The water seal is therefore taken to have sufficiënt 
capacity to maintain the containment pressure below 11 kPa, which is the containment test 
pressure. 

In the event of rising containment pressure, the pressure can be relieved via the "gasmeter" 
bypass or alternatively by a manual operated valve from the control room. The latter will 
induce an uncontrolled release into the control room and is therefore not a preferred 
solution. 

6.3.3.2 Operational and organizational provisions 

The water seal function is preserved by a procedure for controlled pressure reliëf of the 
containment via the "gas meter" bypass. The existing procedure for refilling the water seal 
should be checked for applicability in case of an unfortunate "break" of the seal as to restore 
the confinement function. 

6.3.4 Prevention of re-critically 
6.3.4.1 Design provisions 

If the reactor power deviates more than the permissible deviation as laid down in the OLCs 
the control rods will automatically be inserted by the Reactor Protection System. Large 
deviations or loss of instrumentation will initiate a reactor scram. Re-critica lity is prevented 
by means of a large shutdown margin in negative reactivity. 
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6.3.4.2 Operational provisions 

During the check-out before the reactor start-up each Monday and the measurements done 
during the refuelling process, the core configuration is checked against the restrictions of the 
OLCs (VTS). The OLCs restrict storage areas in the vicinity of the core. OLC also does not 
permit transport of mobile racks in case they are loaded with spent fuel. 

There are no additional means to prevent re-critica lity of the core. 

6.3.5 Prevention of base mat melt through 

The reactor is an open pool type. Uncovering of the core by evaporation of pool water is 
highly unlikely considering the large water quantity that provides decay heat removal 
capacity for a long period (>3 year). Moreover, the core has a limited inventory and the pool 
has a metal liner. The pool floor is made of concrete with a thickness of more than 1.5 
meter. As a second barrier a pipe basement with a concrete floor is situated below the core 
in the pool. Basemat melt through is limited by the heat transfer of the corium to the 
concrete. Since the core inventory is limited compared to the large thickness of the pool 
floor, basemat melt through is expected to be excluded. 

6.3.6 Need for and supply of electrical AC and DC power and compressed air to 
equipment used for protecting containment integrity 

The HOR does not need AC power supply for maintaining safe shut down conditions and / or 
preserving the containment integrity. The water seal is a passive over/under pressure 
protection system. The containment isolation valves are closed by compressed air, stored in 
an accumulator. To open the valves from the control room, electricity is needed. The valves 
can be operated manually on location. A diesel generator is available to provide AC power to 
essential parts of the installation (e.g. instrumentation and monitoring, containment locks, 
and fire alarm system). In addition essential parts of the monitoring system are powered by 
an UPS. 

The containment ventilation system with absolute filters is not connected to the diesel 
generator. This system is not necessary for maintaining the containment integrity but may 
be used to reduce the concentration of airborne radio-active material. 

6.3.7 Measuring and control instrumentation needed for protecting containment 
integrity 

The instrumentation that is used to provide the confinement function in a wide sense is all 
instrumentation that provides status information of the integrity and cooling of the core 
(dose rates, pool water level). In addition the radioactivity of the containment ventilation 
system is monitored in order to initiate containment isolation. 
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6.3.8 Conclusion on the adequacy of severe accident management systems for 
protection of containment integrity 

The loads on the containment are relatively low due to the low power density and the 
absence of pressurised (steam) systems and combustible sources. The water seal and the 
gas meter bypass are considered effective means to protect the containment integrity and 
with that the confinement function. 

6.3.9 Measures to enhance capability to maintain containment integrity after 
occurrence of severe fuel damage 

The existing procedure for refilling the water seal should be checked for applicability in case 
of an unfortunate "break" of the seal as to restore the confinement function. 
If practically achievable, connect the containment ventilation system to the Diesel generator 
in order to maintain filtering capabilities after loss of off-site power. 

6.4 Accident management measures to restrict radioactive releases 

Confinement of radioactivity is preserved by: 

• Confinement barrier approach: Fuel matrix, Fuel Cladding, Primary system, 
Containment; 

• Control and filtering of pool water; 

• Control and filtering of (radioactive) airborne material at inlet and outlet of the 
ventilation system; 

• Isolating the reactor hall in case the concentration of radioactive material exceeds 
discharge limits by closing the isolation valves of the ventilation system; 

• Possibility of internal circulation and filtering of the air in case isolation is applied. 

6.4.1 Radioactive releases after loss of containment integrity 

During normal shut down conditions no radioactive releases are expected into the 
containment. Even the truck transport door can be opened under the conditions as laid down 
in the OLC. 

After loss of containment integrity the regular ventilation and filtering systems can still be 
used to limit the releases. In Chapter 7 the scenario for Airplane Crash is described where 
the containment integrity could be lost. 
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6.4.2 Accident management after uncovering of the top of fuel in the fuel pool 

6.4.2.1 Hydrogen management 

No Hydrogen management activities are foreseen since no hydrogen production is expected 
within the HOR. 

6.4.2.2 Providing adequate shielding against radiation 

The reactor hall will be evacuated and a Containment Isolation will be initiated before or 
during uncovering of the core because of alarm signals and procedures. When the core is 
uncovered the pool structure will provide shielding. 8 hours after shut down of the reactor 
the dose rate at the edge of the pool during uncovering of the core will be approximately 
100 Sv/h. The dose rate at the reactor hall floor is expected to be in average 4 decades 
lower, i.e. 10 mSv/h as indicated in the Veiligheidsrapport HOR (safety report). Since this is 
an average value and radioactive aerosols may be present, possible accident management 
activities inside the containment are expected to be performed under severe conditions. 

6.4.2.3 Restricting releases after severe damage of spent fuel in the fuel storage 
pools 

This action is equal to restricting releases after fuel damage in the core since spent fuel and 
core a both located in the Reactor Pool. 

6.4.2.4 Instrumentation needed to monitor the spent fuel state and to manage 
the accident 

Equal to the core monitoring systems. 

6.4.2.5 Availability and habitability of the control room 

Equal to the situation of high radiation dose rate inside the containment as described in 
section 6.1.2.4. 

6.4.3 Conclusion of the adequacy of measures to restrict the radioactive releases 

The restriction of radioactive releases is limited to the design provisions of the containment. 
The RID emergency plan prescribes evacuation measures in case of radioactive releases. 
These are considered to be sufficiënt for the HOR. The provisions for uncovering of fuel and 
possible restriction of releases outside the containment are to be analysed further (see also 
recommendation Chapter 7). 
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6.4.4 Measures to enhance capability to restrict radioactive releases 

• An evaluation whether the current plans give sufficiënt guidance in the extreme event 
of uncovering of the fuel. 
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7 Other extreme hazards 



The following extreme events were identified for this analysis: 
Explosion and fire related hazards: 

• internal explosion; 

• external explosion; 

• internal fire; 

• external fire; 

• airplane crash; 

• toxic gases. 

Electrical related issues: 

• large grid disturbance; 

• failure of systems by introducing computer malware. 
Water related issues: 

• internal flooding; 

• blockage of cooling water inlet. 

The following information is elaborated for each of these hazards: 

• General description of the event; 

• Description of how the event could lead to consequences for the safety systems; 

• Elaboration on these consequences regarding the generic safety functions. 

7.1 Internal explosion 

7.1.1 General description of the event 

Internal explosions are defined as those explosions that originate from plant systems and 
plant storages. To protect safety relevant systems against the impact of internal explosions, 
the following measures are included in the design to prevent occurrence of internal explosion 
and to reduce their impact: 

• Application (as far as possible) of inflammable gases and liquids instead of more 
obvious but combustible ones; 

• Reduction of number and volume of explosive materials; 

• Limitation of the releases of explosive materials in case of disturbances; 

• Subjection of the storage of explosive materials to special precautions; 

• Monitoring of risk areas combined with automatic safety measures; 



CSAHOR 31-05-2013 v2 



131/162 



• Ventilation of risk areas. 

In the reactor containment building, gas cylinders are stored on the ground level, first 
platform and second platform and contain only inert or noble gases. The gas cylinders 
contain: 

1. Argon; 

2. Helium; 

3. Nitrogen. 

Release of the gas in the reactor containment building can therefore not lead to an explosive 
mixture. In principle, although unlikely, it is possible for a gas cylinder to rupture. The gas 
content will then be released in a short time into the containment area. The total number of 
stored gas cylinders in the reactor building at the mentioned floor levels is limited to about 5. 

For the other buildings, gas cylinders are stored outside the buildings in special storage 
places which meet international standards. Most gasses are noble or inert gases. The few 
present explosive gasses are nearly all mixed e.g. with 90% Argon. Only under strict 
conditions (special housings and locations) very limited amounts (liters) of explosive gasses 
are allowed to be used in a lab. 

7.1.2 Potential consequences for the safety systems 

In case of rupture of a gas cylinder an extra volume of gas will be released in the reactor 
containment building (maximum content of gas cylinders is 50 litres at 200 bars). In 
comparison to the total volume of the reactor hall (20000 m3), the extra volume is very 
small (0.05 %).The containment is able to deal with this sudden extra gas volume within the 
reactor building. Over pressure in the containment is prevented by a water seal. Although 
small damages to equipment could occur, the resulting forces of a gas cylinder rupture are 
too little to cause damage the pool. 

To minimize the risk of gas cylinder rupture, pressurized gas cylinders as mentioned above 
are to be removed from the reactor hall as much as possible. 

Due to the limited amount of explosive gasses in/outside the other buildings of the RID, no 
significant damage to buildings is expected in case of an occurring explosion. The 
fundamental safety functions of the HOR are not threatened. 
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7.2 External explosion 



7.2.1 General description of the event 

Explosion pressure waves may generally result from accidents in nearby facilities or means of 
transportation. The damage can be caused by pressure wave impact or impact of missiles. 
The potential sources of shock waves are shown in the risk map of the area around the RID 
in Figure 7-1 and indicated with red marks and lines. 
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Figure 7-1: Risk map surroundings of RID 

The risk map shows the risks of death for people (10" 6 /y); the risk of severe damage to 
buildings is assumed to be much lower. 
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The risk map shows that external explosions may originate from: 



• Gas distribution station (aardgas distributie station); 

• Chemical Storage (chem opslag TUD); 

• Oil Company (MPM international oil company); 

• Production of Chemicals (NMI); 

• Petrol station (Tankstation A13); 

• Distribution facility (Ahold, ammonia gas storage). 

The circle around the petrol station along the motorway A13 indicates a risk contour (the 
contour does not include the RID). The risk contour of the other facilities are small and 
limited by the buildings themself and therefore not always on the map. From the external 
storage locations, the chemical storage (chem opslag TUD) is closest to the reactor and has 
the largest amount of combustible substances. 

Explosive or toxic substances may also be transported by the rail road Rotterdam-Den Haag 
(black yellow line at the left hands side of Figure 7-1), main roads N470 and A13 (at the 
right) and by ship at the Schie (at the left). 



7.2.2 Potential consequences for the safety systems 

The distance of the HOR buildings to the main gas pipeline is approximately 700 m. The 
legal Standard for high pressure gas pipelines is a 10" 6 risk contour which is at 5 meters from 
the pipeline. Because of the distance to the pipeline, the shockwave, due to an explosion of 
the main gas pipeline, will be strongly decreased and faded out within a distance of 700 m. 
The risk for containment damage due to an external explosion is therefore negligible. 

In Figure 7-1 the 10" 6 risk contours are shown for the storage facilities of Chemicals. The 
contours do not cover the HOR site. The risk for damage of confinement and thus release of 
radioactivity is therefore negligible. 

The 'Risicoatlas Spoor', published by the Ministry of Infrastructure and Environment (former 
Transport and Water Management) shows that the individual risk of transport by rail is 10" 6 /y 
at a distance of less than 10 meters from the centre of the rail road. The distance to the 
HOR is approximately 1000 m. In case a leakage of explosive gas from a train does not 
explode directly, the possibility occurs that during specific weather conditions a cloud of 
explosive gas is driven by wind to the HOR site. This cloud of explosive gas might be ignited 
by for example the electrical systems at the HOR site. However this scenario falls within 
calculated risk contours, so the risk of this scenario will be very low (< 10" 6 /y) at the given 
distance. 
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A gas explosion caused by an accident with a fuel truck may occur. The distance to the main 
road (N470) is approximately 300 m. No damage to the containment is to be expected due 
to an explosion at that distance. In case of leakage of explosive gas, it is not known if the 
concentration at the HOR site can exceed the lower explosion limit. However, due to the 
limited amount of explosive gasses to be transported by a truck, it is unlikely that an 
explosive mixture will be formed on the HOR site. 

An explosion of gas on a local road near the HOR site could result in damage to the 
outbuildings. It is not known if the reactor building will be damaged, but it is unlikely that 
serious damage will occur (the reactor building is resistant against high pressure loads, as 
was calculated by Comprimo see chapter 4). 

With concern to ship transportation, at this part of the Schie few shipping takes place and no 
chemical industry for supply is located up or downstream. Due to the distance of the Schie to 
the HOR, approximately 600 m, no effects of possible explosions from ships are to be 
expected. 

In conclusion: because the building is not affected by external explosions, the basic safety 
functions will be maintained/ are not jeopardized. 

7.3 Internal fire 

7.3.1 General description of the event 

The risk of an internal fire inside the containment is small due to the low amount of 
combustible inventory (low fire load, soundproofing material of the inner plates of the 
containment is unknown). In addition, all areas (inside and outside the reactor building) are 
equipped with fire detection systems. The system gives audible and visual alarms in the 
control room and is connected to the fire brigade RID (part of ERO). The fire brigade RID 
uses protective clothing, masks and manual fire extinguishing systems. 

The insulation material in the containment, fireproof glass wool, is not in contact with the 
inner environment and placed between the steel wall of the reactor hall and the aluminum 
outer plates. On the inside, plates of soundproofing material are present that are made of a 
synthetic material. Their fire resistance is unknown. 

Diesel fuel is stored outside the containment in the diesel power building. No other 
combustible materials are stored at the HOR site. 

In the context of actualization of fire safety requirements (according to the current fire 
standards in buildings), a fire safety analysis is underway. For this an inventory of fire loads 
per room is made. Further actions on this topic are in progress. 
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7.3.2 Potential consequences for the safety systems 

An internal fire can cause failure of electric cables, which can result in a loss of power (see 
chapter 5). In case of a large fire, safety systems can be damaged resulting in a fail safe 
mode of the safety systems. In this situation the pool stays intact. The reactor is scrammed 
and the residual heat will be removed by the pool water. 

Due to the low fire load in the reactor building, the situation of a large fire is very unlikely. 

Recommendation : investigate/determine the fire resistance of the synthetic plate material at 
the inside of the containment; perform a fire analysis from the viewpoint of nuclear risks. 

7.4 External fire 

7.4.1 General description of the event 

External fires may originate from: 

• Storage and use of combustible materials of organizations outside the HOR site; 

• Trucks, trains and ships carrying flammable material on nearby transport routes. 

Transport of flammable materials is covered in section 7.2 of this chapter (External 
explosion). 

The fire load of the grass surrounding the buildings is so low that spreading of a fire to the 
HOR buildings via the grass is not possible. The HOR confinement is made of steel and has 
as such a very fire resistance. 

A fire at the university chemical storage (Chem Opslag TUD) can cause a lot of smoke and 
sparks. Due to smoke formation personnel in the control room might be forced to leave, 
because this room cannot be isolated completely. 

External fire causing "Loss of off-site power" is not to be expected as offsite power is 
realized through ground cables and not by overhead lines and an open switch yard. 

7.4.2 Potential consequences for the safety systems 

No consequences to the safety systems of the HOR are to be expected from fires coming 
from adjacent storage facilities or material transport. However unlikely (due to intervention 
measures of the fire brigade, see chapter 6), flying sparks may cause fire on the bitumen 
roofs of the control room and HOR outbuildings. Due to this, the control room may be 
heated up significantly causing damage to instrumentation and cabling. In practice, the 
reactor has been shut down a long time before the situation has worsened and emergency 
measures have been initiated (see chapter 6). In the ultimate case, the control room has lost 
all connections to instrumentations resulting in the loss of control and monitoring functions. 
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Due to loss of power, safety systems like RSA, BIS and RIS are "activated" and fall into their 
fail safe positions. This means that the reactor is made subcritical and the pool and reactor 
building are isolated. So the three basic safety functions reactivity control, confinement and 
cooling are ensured. 

7.5 Airplane crash 

7.5.1 General description of the event 

In the initial plant design, Airplane Crash (APC) impact and fire has not been considered as a 
relevant load case since the site is located outside the direct influence range (flying zones) of 
commercial and military airports. However, from 2001, this event has been given 
consideration. 

In case an aircraft crashes in such a way that the reactor hall is not affected, but only one or 
more of the other buildings, then the reactor will be shut down and kept intact. The affected 
buildings and their equipment will however be lost. 

In the worst case, the aircraft crashes directly into the reactor containment and it is assumed 
that the reactor pool will be severely damaged and drained and (a part of) the contents of 
the core will be spread into the environment. So all the basic safety functions are lost. 

7.5.2 Potential consequences for the safety systems 

In the safety report an evaluation of an APC has been made based on the analysis of an APC 
on the BER-II reactor (also a 'swimming pool' research reactor) in Berlin, Germany. It was 
concluded that the consequences for the environment of the RID were limited. However, the 
APC analysis was not made specifically for the HOR. 

In case of an APC on the HOR, the National Response Plan for Nuclear Accidents (Nationaal 
Plan Kernongevallenbestrijding) will come into force. This involves organizations like fire 
brigade, community health service (GGD) and police, with whom preparatory consultations 
have taken place. Also, Severe Accident Management actions will be initiated, to minimize 
the consequences for the surrounding area, as described in Chapter 6 of this report (Severe 
Accident Management). 

Recommendation: Evaluation of the emergency plans which needs to be activated in case of 
an APC with core damage and release of radioactive material. For this, a HOR specific APC 
accident analysis should be performed in order to make reliable estimations of the 
consequences. 
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7.6 Toxic gases 



7.6.1 General description of the event 

Toxic gases may originate from: 

• Toxic gases from the HOR site; 

• Toxic gases from the surrounding companies; 

• Toxic gases from rail, road and ship transportation. The Chemicals could be 
released by a leakage, a fire or an explosion. 

In the reactor building cylinders with non-toxic but potential suffocating gasses Helium, 
Nitrogen and Argon are present (50 liters, 200 bars). Outside the building a tank with 5 m 3 
Nitrogen at 3 bar is stored. This tank is located about 60 meters from the ventilation inlet. 

In the other RID buildings, very limited amounts of toxic gasses are present in the labs. 

In paragraph 7.2.1 the risk map shows the storage locations of Chemicals and toxic gasses 
nearby the HOR site. 

Chemicals released by ship, train and accidents on the main road do not pose a threat for 
the reactor operations. Due to the distance (see Figure 7-1) a potential toxic cloud will be 
significantly dispersed before arrival at the HOR site. A truck accident on the local road in 
front of the HOR site might cause a toxic gas cloud. 

7.6.2 Potential consequences for the safety systems 

An accident with toxic gases may pose a threat to the control room personnel, but will not 
threaten the plant systems. 

As the HOR control room cannot be isolated, a toxic cloud could potentially incapacitate 
control room personnel. In that case, the HOR will continue to run as long as no 
malfunctions or resource shortages occur. Reactor power will decrease in time when the AIS 
is triggered (control rods stay in position). The AIS stops when a difference among control 
rod positions of more than 10% has been reached. Normally, the reactor will however be 
scrammed manually in case of a hazard situation. The residual heat of the reactor is 
removed by the pool. 

7.7 Large grid disturbance 

7.7.1 General description of the event 

Large grid disturbances, including overvoltage, voltage interruption/short circuit and 
frequency transients, could cause damage to the main transformers and the electrical 
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systems behind it; in the worst case causing their permanent unavailability or causing 
damage to safety systems. Damage can also be caused by fire, see sections 7.3 and 7.4. 

7.7.2 Potential consequences for the safety systems 

For the HOR a situation of Loss Of Off-site Power (LOOP) or station black out (LOOP-SBO), 
as described in Chapter 5, does not threaten the fundamental safety functions confinement, 
cooling and reactivity control. 

Pool isolation and containment isolation valves close in case of system failure due to loss of 
electrical power. In these positions the confinement function and cooling function are met. 
The control rods fall into the core when power is interrupted and the magnetic force, 
keeping the rods in position, is cut off. The reactor is brought in a subcritical state and 
reactivity is control led. 

7.8 Failure of systems by introducing computer malware 

7.8.1 General description of the event 

In this report, "failure of systems by introducing computer malware" implies accidental 
invasion of malware in the HOR computer systems. Malware, short for malicious software, is 
software (or script or code) designed to disrupt computer operation, gather sensitive 
information, or gain unauthorized access to computer systems. It is a general term used to 
describe any kind of software or code specifically designed to exploit a computer, or the data 
it contains, without consent. The expression is a general term used by computer 
professionals to mean a variety of forms of hostile, intrusive, or annoying software. Malware 
includes computer viruses, worms, Trojan horses, spyware, dishonest adware, most rootkits, 
and other malicious programs. This accidental invasion could be accomplished either by 
users of the HOR, or by those with an internet connection. 

The safety related systems are controlled by the RPS which uses computerized and non- 
computerized electronic hardware, like EEPROM (Electrically Erasable Programmable Read- 
Only Memory) and hard-wired systems. Irradiation experiments and other experiments with 
radioactive material are often equipped with PCs, but these are never connected to the 
facilities safety systems. 

The electrical main switchboards of the HOR (low voltage room) are equipped with a 
computerized parameter control and monitoring system. It is not connected to an external 
network. lts control capability is locked, but can be unlocked with special keys. 

The HOR control room is equipped with a process computer. It is used for presentation and 
registration of process variables and for the automatic control of the reactor power. The HOR 
Computer is connected to a special dedicated HOR network that can be accessed from one 
other TUD building outside the RID for remote monitoring. Theoretically it could be accessed 
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from inside, and false information could hypothetically enter through this access. This might 
cause confusion under the control room personnel, however important process parameters 
are also available on the reactor instrumentation directly. There is no connection to the 
HOR's reactor protection system, see Figure 7-2. 



Reactor veiligheidsysteem 



RSA, RIS, 
BIS, ... 



Computer 




REACTOR 



Figure 7-2: Relation of HOR Computer to the reactor protection system 

The independent CAMAC system is used as data acquisition and interface system between 
the HOR computer and the reactor and it houses the AIS system. 

7.8.2 Potential consequences for the safety systems 

The safety systems of the HOR are controlled by computerized and non-computerized 
electronic hardware. The reactor protection system is independent of the HOR computer. 
Failure or spurious actions of this computer cannot result in a threat to the fundamental 
safety functions. The experiment information computers are solely supportive for plant 
control: they only show information, but does not control plant systems. AH this, in 
combination with an intact pool, offers sufficiënt protection on forehand for the reactor and 
its safety systems. 

Theoretically the process information system in the HOR control room could be accessed 
from inside and false information could hypothetically enter through this access. This might 
cause confusion under the control room personnel. However, according to their procedures 
they will only take action if the information is confirmed by readings of the analogue 
instrumentation on the control console and panels. 



140/162 



CSA-HOR 25-04-2013 v1.1 



7.9 Internal flooding 



7.9.1 General description of the event 

By definition internal floods are floods that originate from systems that are part of systems 
that constitute the HOR operations. In the reactor building (including pipe basement), this 
might originate from leakage of cooling water, demin water systems or storage tanks. The 
public water supply system is a potential source of flooding in all buildings. 

The design criteria to mitigate internal flooding and their consequences focus on: 

• Appropriate design: this means that by plant layout and system design, mitigation 
is effective e.g. by: 

o proper design to prevent leakages; 
o flow paths to accumulation areas; 
o dra in systems; 

o protecting electrical systems against water ingress when submerged or 
wetted; 

o thresholds, protecting other areas. 

• Procedures: normal operating and/or emergency operating procedures will 
support/guide operator actions to control internal flooding; 

• Detection systems: means for detection of leakage or flooding are available. For 
leakage detection these means can refer to system process parameters such as 
the level, flow, temperature and pressure of the water. For detection of flooding, 
means can be based on flow or mass detection of drain systems or water level 
indication in (assigned) accumulation areas. 

Identified water sources 

Water originates from bulk stored inside or from systems having large mass flow capacity 
while externally supplied. (Large) water volumes or supplies inside the different buildings 
are: 

777e reactor building: 

• Pool; 

• Storage tanks in the basement; 

• Primary cooling water system (pipe basement); 

• Secondary cooling water system (pipe basement); 

• Public water supply system (including fire fighting systems). 

The pump building: 

• Secondary cooling water system; 

• Public water supply system. 
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Other buildings: 

• Public water supply system (including fire fighting systems). 
Affected areas 

Reactor building-basement 

In case of a leakage of a storage tank or the public water supply system in the water 
treatment room, which is located in the basement (Figure 7-3), water is collected in drains 
via trenches in the floor. The water is pumped to collection tanks. In case of severe leakage, 
for instance of the large tank Tl (250 m 3 ), water collects at the floor when the collection 
tanks are fully filled and partly flows to the adjacent building part, Wing 4. The water height 
on the floors will be a few centimetres. Electrical component enclosures are positioned at a 
height from 30 cm. Several water detection systems are installed in this water treatment 
room, giving only alarm (no automatic actions). 




Figure 7-3: Water treatment room in the basement 

In case of leakage of the primary or secondary cooling water system in the pipe basement 
(Figure 7-4), the contents of the pipe system will collect at the floor and pumped (partly) 
away by a drain pump. The leakage of the primary system is limited due to the automatic 
closure of the pool isolation valves, which is actuated when pool level decreases (actuates at 
~ 7cm below maximum water level). Leakage of the pool liner is detected by collecting 
vessels (inspected weekly). The level of the possible remaining water on the floor is limited 
(maximum in order of centimeters). The primary pump is positioned at a height of 20 cm. 
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In case of severe leakage of the pool, the pipe basement is flooded. The water flow path 
from the pipe basement is via the pipe penetrations to the pump building of the secondary 
system. 




Figure 7-4: Pipe basement 
Reactor building-ground level 

Due to leakage of water from the public water supply system or the pool, water collects at 
the floor of the reactor building. The wall and doors are watertight. Penetrations to the 
basement are gastight so water does not flow to the basement. 

Pump Building 

In case of water leakage, the water collects at the floor and flows through small openings to 
the environment. However water inside the pump building (both secondary cooling water 
and water from the public grid) does not contain any radioactivity. 

Reactor outbuilding 

In the low voltage room (laagspanningsruimte), Figure 7-5, no water supply system is 
located. Due to water leakage of the public water supply in adjacent rooms the floor might 
be wetted, but water flows to lower levels in-and outside the building, and a high water level 
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will not be reached to cause a failure of power supply or loss of instrumentation of the 
reactor protection system. 

Reactor outbuilding-Control room 

In a side area of the control room tap water is available. Due to water leakage of the public 
water supply system the floor of the control room may be wetted. Water flows away via 
openings under doors to the roof or via the staircase to lower floors. The panels in the 
control room are raised and cable penetrations to the control room are leak tight. 

7.9.2 Potential consequences for the safety systems 

Due to internal flooding the safety systems are not affected. The potential amounts of water 
causing internal flooding are limited and cannot cause high water levels (up to a few 
centimetres) of the basement and ground floor of the reactor building, except for the case of 
severe pool leakage. In that case the pipe basement is flooded to the level of the pipe 
penetrations of the secondary system. The primary pump fails. 

The water content in the pipe basement, in case of severe pool leakage, does not influence 
accident management actions with regard to the filling of the large storage tank Tl (Tl is 
connected to the pool and can be used to fill the pool by means of levelling). In these 
accident management actions a pipe has to be connected to Tl, which is a manual action, to 
fill Tl with water from the fire fighting system (hydrant leiding). For this, the pumps in the 
water treatment room (the basement in which Tl is located) have to be used. These pumps 
are positioned at a height of 40 cm and are not flooded. In case of failure of these pumps, 
Tl can be filled in the manhole at the top of Tl via fire hoses. 

Instrumentation and electrical cabinets in the control room and low voltage room are not 
threatened by a rupture of nearby public water supply systems. 




Figure 7-5: Electrical cabinets in the low voltage room at ground level 



144/162 



CSA-HOR 25-04-2013 v1.1 



7.10Blockage of cooling water inlet 

7.10.1General description of the event 

Cooling water blockage is defined as blockage of the flow of the secondary cooling system. 
This results in loss of ultimate heat sink. 

7.10.2 Potential consequences for the safety systems 

In chapter 5 LUHS is described. 
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Appendix A Equipment of auxiliary systems 
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Figure A-l: Equipment at elevation +0 meter 
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Figure A-3: Equipment at elevation +7.5 meter 
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Figure A-4: Equipment at elevation +10 meter 
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Figure A-5: Equipment in auxiliary building 
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Appendix B Electrical power system 

Line diagrams 
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Appendix C Back-up power consumers 



Kast trafo- 1 


Functie 


IKF 


Ionenwisselaar V1/V2 


IKO 


besturing perslucht/vacuum en CV inst. 


KKM 


Noodverlichting oostvleugel / regelkast IKAJ en IKAK / voedingen versnellerruimte 


KKMA 


Is regelkast IKAK t.b.v. RA en MIRA putpomp in oostvleugel 


IKAJ 


Regelkast t.b.v. luchtbehandeling versneller en labs nieuw oost 


KBP 


Vorstpomp P3-2MW + niveau signalering koeltorens. 


LBP-KBR 


Noodverlichting vleugel 1 en 2 / hydrofoor vleugel 1 en 2 / ser ruimtes vleugel 1 en 2 


KVC 


Inbraakcentrale regelkamer + reactorhal / diverse krachtaansluitingen vleugel le 
verd. 


KKH-LKD 


Brand meidcentrale / omroep- ontruimingsinstallatie / 3x MIRA putpompen / SER B 


IKP 


besturing gemeentewater druk verhoging gebouw 


KKHB 


Vervallen 


CKA-PZI 


Instrumentatie kast personen zoek installatie (pagersysteem) 


IKE 


Storing signalerings paneel in waterbehandeling 


NBX 


Nood verdeelkast t.b.v. experimenteerhal. 


KRA 


Bassindeur t.b.v. reactorbassin 


KRB 


Koelmachine AC-46 t.b.v. Ibh regelkamer complex en HOR paneel / voeding voor IRE 


IRE 


Regelkast t.b.v. Ibh regelkamer complex en HOR paneel 








Kast trafo-2 


Functie 


IBN 


besturingskast noodgenerator. 


KKK 


Diverse RA en MIRA pompen / SBD meetstation terrein 


IKD 


besturing putpomp hergebruik systeem 


IKJ 


regeling koelwater systeem gebouw 


IBD 


besturing koelcel 


IKAF 


besturingskast CV ketels, branders en pompen. 


IKAC 


Regelkast t.b.v. luchtbehandeling noord-, zuid- en oostvleugel. 



CSAHOR 31-05-2013 v2 



159/162 



Kast trafo-3 


Functie 


NVA 


Noodverl. vleugel le verdieping / noodverl. personensluis / verl. HOR archief 


IKT 


Regelkast t.b.v. luchtbehandeling oost vleugel en dierenlab 


NBA 


Noodverlichting algemeen / MER 


Mi/n 

NKB 


Diverse camera's / diverse netwerk patchkasten 


Ml/n A 

NKB-A 


Diverse beveiligingsinstallaties loge / toegangscontrole 


/•— I//— 

CKC 


instrumentatie kast Intercom (loge) systeem buiten hek en buiten deuren + BHO kast 


Cl/ A 

SKA 


kast tbv camera's en monitoren portiers loge 


SKB 


Besturingkast buiten hekken 


Brand meld 


Brandmeldinstallatie 


NIRA 


Pagerrek 


Tn a / m n a 

IRA/NRA 


Hal alarm / subkast inbraakbeveiliging / verlichting bovenkrans / stelstaafmotoren 


T 1/ A /Ml/A 

IKA/NKA 


\/aaJZiam • * a a bi Tl/ AA / Tl/A /"* / 1 H / Maa Ji fAbilinUiiHH » 1 ^, « a A in / /"* _ _J a^ a a^Z a 

Voeding voor IKAA / IKAG / LCl / Noodverlichting algemeen / Gasdetectie 


Tl/ A A 

IKAA 


besturings kast bassinwater transport- zuiverings- hergebruiksysteem 


Tl/ A 

IKAG 


besturingskast demiwater aanmaaksysteem en registratie apparatuur 


IKF 


verplaatst naar trafo- 1 veld 4.3 


LC1 


besturingskast luchtsluis beganegrond, en voeding voor bovensluis en personensluis 


LC2 


bestruringskast luchtsluis verdieping 


LC3 


besturingskast personensluis verdieping 


LRB 


Noodverlichting regelkamer / HOR paneelkast 3, 4, 5 en 6, HOR computer / 
Lessenaar 




in regelkamer / Intercom installatie HOR / Camerasysteem reactorhal en regelkamer 


CKB 


instrumentatie kast intercom installatie HORB 


LBL 


MER 
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Appendix D Assessment of heat removal capacity of 

the pool 



This appendix details the assessment of the decay heat removal capacity of the pool of the 
HOR for the situation that decay heat of the core and of the spent fuel that is stored in the 
pool are absorbed by the pool water. 

The emphasis of this assessment lies on boil-off of the pool water because an indication is 
requested of its availability in time as an alternate heat sink. This means that, conservatively, 
heat-up of the pool water is neglected. 

Decay heat curve of the core is provided by RID. This curve is also used for the spent fuel. 
Both contributions are assessed in the following way: 

• For the decay heat of the core, the most severe situation is that the reactor will be 
shut down at the moment it is operated at maximum power, namely 3 MW; 

• For the spent fuel the following applies: 

Since 2005 every year 3 elements of the core are replaced by fresh ones. The spent 
fuel elements are stored in the pool. The number of spent fuel elements almost 
equals one core. On average these elements have operated at 2 MW, as this is the 
usual power level the HOR is operated at. As this exchange is performed in sequence 
of approx. 4 months it is assumed that conservatively, the heat production of these 
24 stored elements equals the production of a core that is operated at a 3 A level of 
the 2 MW core. This means that for decay heat calculation 1.5 MW is the starting 
point. 

For the assessment of the heat dissipated into the pool a virtual core power at shut 
down of 4.5 MW is assumed. Figure D-l shows the decay heat curve for this 
situation. 
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Figure D-l: decay heat dissipated into the pool of the HOR as function of time. 

Based on this heat production the amount of water that is needed to remove this 
heat by boiling only is calculated. Figure D-2 shows the results. From this figure it can 
be concluded that after approx. 3 year 160m 3 of pool water is boiled-off. 
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Figure D-2 : Amount of pool water boiled of as function of time (adiabatic conditions). 
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